Securing Event-Driven Architecture (EDA)

 While reading this enumeration of EDA software patterns I had to think of the need for available Cyber reference architectures (RAs) and minimum security baselines (MSBs) to complement misuse test cases, especially for logic.

With cloud-native and FaaS gaining ground, as well as no/low code, Cyber will need to collaborate even closer with QA to determine any confidentiality, integrity &/or availability (CIA) issues. 

AWS Lambda, Serverless Function-as-a-Service (FaaS), Primer

AWS paved the way via FaaS years ago.  However, I have yet to find a succinct, aggregation of best practices on how to use & deploy these solutions.  So, here you go:

Overview/Serverless Application Model (SAM): https://d1.awsstatic.com/whitepapers/serverless-architectures-with-aws-lambda.pdf; https://aws.amazon.com/blogs/compute/building-well-architected-serverless-applications-approaching-application-lifecycle-management-part-1/; https://aws.amazon.com/blogs/compute/category/compute/aws-serverless-application-model/; https://docs.aws.amazon.com/wellarchitected/latest/framework/wellarchitected-framework.pdf

Orchestrating serverless services: https://theburningmonk.com/2020/08/choreography-vs-orchestration-in-the-land-of-serverless/

Tracing & monitoring Lambda: https://www.infoq.com/articles/tracing-aws-lambda-functions/; https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-cloudwatch-metrics-logging.html

Negating latency challenges with cold starts: https://epsagon.com/development/how-to-minimize-aws-lambda-cold-starts/

Securing Lambda functions: https://medium.com/orchestrated/steps-to-secure-aws-serverless-lambda-part-1-a6e5d1b05f45

Edge functions: https://www.stackery.io/blog/lambda-at-edge/

Securing edge functions: https://aws.amazon.com/blogs/networking-and-content-delivery/authorizationedge-how-to-use-lambdaedge-and-json-web-tokens-to-enhance-web-application-security/ 

Tagging: https://www.cloudforecast.io/blog/aws-tagging-best-practices/