Serverless Security book cover

How Do I Implement Serverless Security on AWS, Azure and Google Cloud?

"There is a lack of good practices out there." (From a security researcher)
What is there to secure when there are no servers?
Our security engineers are not familiar with serverless computing.

Get Your Copy

Free Mini-Course

Learn a Systematic Approach

Enhance your security in your serverless application by using a systematic approach to assess and remediate security concerns.

Use Code

See and download code examples, and get recommendations.

The Big Three
Cloud Providers

Learn from examples for AWS, Azure and Google Cloud.


Learn how to perform a risk assessment.


Balance risk and business requirements.

No More
Blog Posts

Stop searching through countless blogs to learn serverless security.

Avoid Simple Checklists

Checklists are great, but sometimes they lack comprehensive information.

What About
Google Cloud?

There seems to be little information about serverless security for Google Cloud.

What about

Finding security recommendations in the Azure docs can be difficult.

Introducing the Serverless Security book

A comprehensive book on serverless security that covers AWS, Azure, and Google Cloud.


Total Chapters




Chapters with Code

Why Read This Book?

"Miguel is a gifted cyber professional with the rare combination of technical skills, an eagerness to learn, and the ability to communicate complex topics that anyone can understand in both verbal and written word."

Jon Santavy, Founder, Wuvavi, an information security awareness company

"I've worked with Miguel in industry for years and wouldn't trust anyone more to 'batten down the hatches' for my products and businesses. In fact, several of our products have been blessed by Miguel and his cyber security expertise through penetration testing, security management, code review, among other techniques. Like any good SME, Miguel will give you the facts and provide solid recommendations to place your business on solid footing. I look forward to review and implement Miguel's writing and recommendations!"

Christopher Higgins, CEO, Utility Player, Engineer, Innovator

"Miguel brings a thoughtful and unique perspective to the team when trying to solve complex problems. Miguel is an excellent writer and is able to distill key information to inform business prioritization decisions. He has a passion for cyber security and helped our team maintain a focus on security continuously throughout the software development lifecycle."

Adelaide Sinclair, Product Owner and Service Delivery Manager, Transurban

"Miguel has worked hard to develop broad, insightful experience in cyber security and web services, and is an expert in the emerging field of server-less enterprise solutions."

J.R. Richardson, ESEP, Engineering Fellow, Raytheon Technologies

The Chapters

Chapter 1 · Introduction to Cloud Computing Security

In this chapter, we will review cloud computing and how its security evolved. We will learn how serverless computing relates to cloud computing and how securing serverless computing differs from the typical cloud computing Cybersecurity. We Cybersecurity, how it applies to cloud computing, and why it is needed. This chapter will set the foundation for Cybersecurity in serverlesscomputing by putting it in the context of cloud computing and its security.

Chapter 2 · Performing a Risk Assessment

In this chapter, we will learn how to perform a risk assessment for a serverless application. We will explore how to understand how the application works, which includes reviewing documentation, source code, and system accounts and using the application. We will discuss why we scope the risk assessment. We will learn how to develop a threat model and how to use it to start creating the risk assessment.

Chapter 3 · Securing the Code

In this chapter, we will review the importance of securing the application code. We will learn how to choose the runtime and version for our serverless functions and how to assess any libraries and dependencies they use. We will discuss static code analysis tools, unit tests, and regression tests and how they help secure our application code. Finally, we will learn how multiple events can trigger serverless functions and review examples on performing input validation on those events.

Chapter 4 · Securing Interfaces

In this chapter, we will review the function triggers and provide a use case for each. We will discuss how to identify the different interfaces defined in the Serverless configuration file and function code.

Chapter 5 · Configuring the Application Stack

In this chapter, we will review the organization of the Serverless configuration file. We will explore good practices for us to consider using in each configuration section.

Chapter 6 · Restricting Permissions

In this chapter, we will discuss how we might use permissions in AWS, Azure, and Google Cloud. We might consider them as a first-line defense in our serverless environment from attacks on functions and account takeovers. Therefore, we should understand how to implement them. We will learn the permission capabilities each provider has and how we might use them.

Chapter 7 · Account Management

In this chapter, we will discuss how we might manage our account to reduce risk and improve security. The provider account allows us to access multiple services and create numerous resources. We will learn how we might use various accounts to organize the resources we create and how to secure our account by implementing standard practices.

Chapter 8 · Secrets Management

In this chapter, we will discuss how you might protect our secrets using provider services. We will explore the various ways AWS will enable us to encrypt secrets. Based on this exploration, we will select an approach that has a balance between encryption and convenience, and explore that approach in Azure and Google Cloud.

Chapter 9 · Authentication and Authorization

In this chapter, we will define authentication and authorization. We will review different approaches for implementing both in our serverless application, discuss where those approaches might apply, and provide some security practices for each. Lastly, we will review services and capabilities that AWS, Azure, and Google Cloud provide to help us implement authentication and authorization.

Chapter 10 · Protecting Sensitive Data

In this chapter, we will discuss some principles for protecting sensitive data. We will consider sensitive data to be information that are not secrets but might still result in damage when putting multiple pieces of data together. For example, driver’s licenses, birthdays, medical history, and so on are sensitive data. We will learn how to apply these principles in the cloud provider services, the software used to build the application, and the application configuration.

Chapter 11 · Monitoring, Auditing, and Alerting

In this chapter, we will discuss monitoring, auditing, and alerting. We will consider monitoring to be the process and tools we use to assess our application, auditing to be the process of looking for deviations from desired settings, and alerting to be the notification process when there are monitoring and auditing findings. We will review cloud provider services we can use to implement monitoring, auditing, and alerting.

Chapter 12 · Additional Considerations

In this chapter, we will review additional topics for us to consider in our project. They are based on situations from projects using the Serverless Framework and Cybersecurity concepts. The topics we will review are in no particular order and were reserved for the penultimate1 chapter to share additional thoughts without disrupting the main messages from the previous chapters.

Chapter 13 · Finalizing the Risk Assessment

In this chapter, we will discuss how to finalize the risk assessment we started in Chapter 2 to present it to our business stakeholders.

Are you ready to secure your serverless application?

Buy Now