WARNING: The purpose of the workshop is to provide a starter API which does NOT follow many security best practices on purpose. The tutorial modules guide you to identify security gaps in the starter app, and implement protection measures for them.

Furthermore, the modules do not cover ALL the security measures that should be applied. After completing all modules, we recommend you to explore additional protections, such as ensuring the principle of least privilege. See the Extra Credit section for more details.

In this workshop, you will learn techniques to secure a serverless application built with AWS Lambda, Amazon API Gateway and RDS Aurora. We will cover AWS services and features you can leverage to improve the security of a serverless applications in 5 domains:

1. identity & access management
2. infrastructure
3. data
4. code
5. logging & monitoring

Workshop URL: serverless-security-workshop

The documentation is made available under the Creative Commons Attribution-ShareAlike 4.0 International License. See the LICENSE file.

The sample within this documentation is made available under a modified MIT license. See the LICENSE-SAMPLECODE file.