3 ms·
FaaS helps here. It's easier to reason about the access one function does than all the infra a monolith needs to access.
by k__ 6y ago
FaaS helps here.
It's easier to reason about the access one function does than all the infra a monolith needs to access.
- coredog64 6y agoYou’d think that, but Friday I just helped a dev team deploy a Lambda function that had full capability to update any Lambda in the account. The devs didn’t know anything about how the app worked, since it was a drive-by from the architect. He, in turn, just grabbed an AWS blog post, confirmed that it worked in his personal account, and called it a day. Also, since the devs don’t know IAM, every resource request is a wild card. A function compromise would allow deployment of a new function that could extract every SSM secret, Cognito identity, and S3 object.