Practical walk–through

Now that we have seen the best practices and pointers for covering the security aspects of a system, let's do a hands-on exercise to implement the security in the Greeter API that we created in Chapter 2, AWS Serverless Offerings.

To do this, we need to create a test bed by extending the current scope of the Greeter lambda function to talk to the RDS instance and execute a simple database query. With this set up, we have a simplified version of the actual LetsPoll APIs that can be looked at cross-sectionally.

The setup is as follows:

• API Gateway calls out to the Greeter lambda function
• The Greeter lambda function makes a DB call
• The database credentials are hardcoded in the lambda function
• The PostgresDB has a master user
• The Postgres RDS DB is in a public subnet

...