Serverless is not "no servers to secure": Lambda lessons for SMBs
Small functions, large surface. IAM, secrets, cold starts, and logging in serverless architectures we see in PR startups.
AWS promotes serverless as simplification; AWS Security Blog also warns poorly designed per-function permissions multiply vectors. Startups in Puerto Rico deploy Lambdas behind API Gateway for MVPs — fast — but leave secrets in env vars shared across functions and infinite timeouts that enable abuse.
Per function: minimum IAM role, secrets in Secrets Manager o
Per function: minimum IAM role, secrets in Secrets Manager or SSM Parameter Store (not hardcoded), input validation at edge (API Gateway validators + Zod in handler), rate limiting and WAF on API Gateway or CloudFront. Log groups with defined retention and alerts on 5xx error spikes.
Understand cold start vs security: large container images de
Understand cold start vs security: large container images delay but do not remove runtime patching need. Dependency scanning applies equally — your node_modules layer can have CVEs.
Event-driven amplifies risk: misconfigured S3 trigger processes malicious uploads; SQS poison messages retry forever. Dead-letter queues and retry limits are operational security controls, not just reliability.
Serverless works for SMBs when governance grows with function count — inventory, naming convention, owner tags. Otherwise in 18 months you have 40 Lambdas nobody remembers creating, with production access.
Operations and execution — connecting strategy with what the team ships every week.
