Serverless Security Patterns: IAM, Cognito, Secrets आणि WAF

By Ravindra Bagale, trainer · LinkedIn · Last updated: 2 November 2026

1. रोजचे: leaked key

Mei (SGD) key in env+git. Secrets Manager + scan = रोक.

Roles: IAM roles; users: Cognito; data IAM: DynamoDB security; edge: WAF.

2. का layers?

हे का लागतं?

Lambda magic नाही. Broad roles, public API, env secrets = usual breach. Layers.

हे काय आहे?

Cognito = identity. IAM = AWS API rights. Secrets = runtime creds. WAF = web ACL.

3. Vertical diagram

4. How: checklist

कसं करायचं (step by step)

5. Commands

STS

aws sts get-caller-identity

अर्थ: IAM edit आधी principal.

Get role

aws iam get-role --role-name checkout-api-role --query 'Role.{Arn:Arn,Trust:AssumeRolePolicyDocument}'
aws iam list-attached-role-policies --role-name checkout-api-role

अर्थ: Attach आधी read.

Secrets list

aws secretsmanager list-secrets --region ap-south-1 \
  --query 'SecretList[].Name' --output text

अर्थ: Secrets inventory.

Throttle

aws apigateway get-stages --rest-api-id APIID --region ap-south-1 \
  --query 'item[].{S:stageName,T:throttleSettings}' 

अर्थ: Rate limits ठेवा.

6. Industries

• Fintech IAM.
• PHI+rotate.
• Ecommerce WAF.
• SaaS claims.
• Gov IdP.

7. Lab

8. Lab - security pass

Org block नसेल तर ap-south-1 (Mumbai). आधी budget alert.

कसं करायचं (step by step)

1. STS.
2. List policies.
3. No plaintext.
4. WAF sketch.

Cleanup (billing थांबवा)

1. No Admin.
2. Revoke widen.

9. एकाच pattern — वेगवेगळ्या industries

• Fintech (Aisha, Lagos): payment webhooks → SQS → Lambda.
• Ecommerce (Rohan, Pune): checkout API; inventory SNS fan-out.
• Healthcare (Mei, Singapore): SNS SMS; PHI + fine-grained IAM.
• EdTech (Diego, São Paulo): EventBridge nightly cleanup.
• Logistics (Fatima, Casablanca): EventBridge + saga.
• Media (Kenji, Osaka): S3 → Lambda thumbs + fan-out.
• SaaS (Priya, Bengaluru): Cognito + per-tenant partition.
• Gov (Omar, Amman): strangler fig per form route.

10. Troubleshooting checklist

1. Region confirm करा.
2. CloudWatch Logs + request id.
3. Execution role permissions.
4. DLQ + oldest message age.
5. curl -v + CORS.
6. SFN event history.
7. Linked chapter पुन्हा वाचा.
8. Cost: concurrency/retries.

11. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

12. FAQ

13. Interview Q&A (Beginner / Mid / Senior + MNC)

14. Tips — English, मराठी आणि हिंदी

15. Architecture decision checklist

1. User journey 5 bullets, no AWS names.
2. Sync vs async mark.
3. Failure mode.
4. Idempotency key.
5. Data from access patterns.
6. Cost 1x and 10x.
7. Quotas ap-south-1.
8. Auth decision.
9. On-call + alarm.
10. Deep chapter link.
11. मग console/IaC.

16. Copy-paste quick commands

# Region and identity
aws configure get region
aws sts get-caller-identity

# Lambda landscape
aws lambda list-functions --region ap-south-1 --max-items 20 \
  --query 'Functions[].{N:FunctionName,R:Runtime,T:Timeout,M:MemorySize}' --output table
aws lambda get-account-settings --region ap-south-1

# API Gateway (HTTP APIs)
aws apigatewayv2 get-apis --region ap-south-1 --query 'Items[].{N:Name,Id:ApiId,Ep:ProtocolType}' --output table

# Queues and topics
aws sqs list-queues --region ap-south-1
aws sns list-topics --region ap-south-1 --query 'Topics[].TopicArn'

# Event buses and state machines
aws events list-event-buses --region ap-south-1
aws stepfunctions list-state-machines --region ap-south-1 --query 'stateMachines[].name'

# DynamoDB tables (names only)
aws dynamodb list-tables --region ap-south-1

Sandbox + read-only IAM.

17. अजून industry आणि stack stories

• Fintech Lagos: webhook → SQS → idempotent ledger.
• Ecommerce Pune: throttle + fan-out.
• Healthcare SG: SNS + PHI IAM.
• EdTech: EventBridge cleanup.
• Logistics: bus + saga.
• Media: avoid recursive S3.
• SaaS: tenant partition.
• Gov: strangler peel.
• Startup: Function URL → HTTP API.
• Retail: FIFO vs Standard.

• Python: thin handlers.
• Node: async/await.
• Java: SnapStart.
• .NET: package size.
• Go: static binary.
• PHP: hybrid.

18. Glossary

19. Practice: मोठ्याने explain

1. 60s: serverless security गोष्ट.
2. 60s: sync vs async checkout.
3. 60s: Lambda नको कधी.
4. 60s: DLQ + idempotency.
5. Record ×2.

20. Safe lab hygiene

• Tag owner+expiry.
• Budget alarm आधी.
• Read-only first.
• Cleanup.
• No secrets in env/screenshots.
• No provisioned on hello.

21. या chapter च्या links

• Compute: Lambda.
• HTTP: API Gateway.
• Data: DynamoDB.
• Messaging: SQS/SNS.
• Events: EventBridge.
• Workflows: Step Functions.
• build-* projects link.

22. Myths

23. Serverless error budget

Checkout error budget 0.1% असेल तर aggressive retries email duplicates देऊन budget जाळू शकतात. Money SLO ≠ notify SLO.

1. दोन SLOs.
2. Money retries bounded.
3. Notify best-effort.
4. Money page; notify ticket.

24. Regional notes (ap-south-1)

• Labs Mumbai.
• Feature availability.
• Data residency.
• Latency India.

25. Naming conventions

# Suggested prefixes
# Lambda:  pay-intake-prod, pay-worker-prod
# SQS:     pay-orders.fifo / pay-orders-dlq
# SNS:     pay-order-events
# EB bus:  pay.domain
# SFN:     pay-refund-saga
# DDB:     pay-orders-prod

env + domain नावात ठेवा. CloudWatch grep सोपा.

26. Pre-mortems

1. Double charge headline.
2. DLQ drain plan.
3. Cognito outage mode.
4. Runbook.

27. Currency / locale

Currencies आणि names rotate करा — global mental model.

28. Stolen secret

1. Secret in git.
2. Rotate SM.
3. WAF+sig.
4. Git scan.

29. Anti-patterns

• Shared role.
• Auth off prod.
• Log Authz.

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.