# \#security **URL:** https://forum.serverless.com/tag/security/8.md [Latest](https://forum.serverless.com/latest.md) · [Categories](https://forum.serverless.com/categories.md) · [Tags](https://forum.serverless.com/tags.md) --- ## [SERVERLESS\_LICENSE\_KEY, SERVERLESS\_ACCESS\_KEY -- github actions based CI/CD](https://forum.serverless.com/t/serverless-license-key-serverless-access-key-github-actions-based-ci-cd/21300)
**Author:** [@rafalwawrzkowicz](https://forum.serverless.com/u/rafalwawrzkowicz)\ **Replies:** 2\ **Last updated:** [March 31, 2026, 6:21pm UTC](https://forum.serverless.com/t/serverless-license-key-serverless-access-key-github-actions-based-ci-cd/21300 "2026-03-31T18:21:35Z")
We are small team od devs and migrating now to v4. We have already serverless subscription acquired from AWS marketplace. Our CI/CD is based on gh actions workflows. For start we plan to use serverless from CLI mainly, b… --- ## [How do you configure your Serverless setup, Github and AWS such that you are secure from 3rd party developers](https://forum.serverless.com/t/how-do-you-configure-your-serverless-setup-github-and-aws-such-that-you-are-secure-from-3rd-party-developers/21099)
**Author:** [@random1077](https://forum.serverless.com/u/random1077)\ **Replies:** 1\ **Last updated:** [November 11, 2025, 7:41pm UTC](https://forum.serverless.com/t/how-do-you-configure-your-serverless-setup-github-and-aws-such-that-you-are-secure-from-3rd-party-developers/21099 "2025-11-11T19:41:21Z")
tldr: Can I set up dev/staging/prod in a way that secures my code? I am fortunate to have a very talented off shore developer but he is in a part of the world where we need to be careful. It’s not a reflection on him b… --- ## [Serverless CRM Workflows: Automating Sales Pipelines with AWS Lambda + AI](https://forum.serverless.com/t/serverless-crm-workflows-automating-sales-pipelines-with-aws-lambda-ai/21261)
**Author:** [@MikeJason](https://forum.serverless.com/u/MikeJason)\ **Replies:** 1\ **Last updated:** [November 1, 2025, 9:15pm UTC](https://forum.serverless.com/t/serverless-crm-workflows-automating-sales-pipelines-with-aws-lambda-ai/21261 "2025-11-01T21:15:36Z")
We’ve recently been developing CRM automation workflows using a fully serverless architecture, primarily AWS Lambda combined with Step Functions. The goal is to streamline and scale common sales and marketing tasks li… --- ## [Using lambda env vars encryption in transit feature](https://forum.serverless.com/t/using-lambda-env-vars-encryption-in-transit-feature/21073)
**Author:** [@yardensade](https://forum.serverless.com/u/yardensade)\ **Replies:** 0\ **Last updated:** [March 22, 2025, 9:49am UTC](https://forum.serverless.com/t/using-lambda-env-vars-encryption-in-transit-feature/21073 "2025-03-22T09:49:22Z")
AWS offers in the lambda configuration (aws console) option to encrypt the environment variables. Encryption in transit → Enable helpers for encryption in transit I can’t find any reference for this in serverless frame… --- ## [The bucket does not allow ACLs](https://forum.serverless.com/t/the-bucket-does-not-allow-acls/20788)
**Author:** [@sebamancini](https://forum.serverless.com/u/sebamancini)\ **Replies:** 1\ **Last updated:** [January 30, 2025, 4:24pm UTC](https://forum.serverless.com/t/the-bucket-does-not-allow-acls/20788 "2025-01-30T16:24:28Z")
Hi, I am setting a lambda function that creates an image and puts it on a bucket. I am facing this issue: \[ERROR\] ClientError: An error occurred (AccessControlListNotSupported) when calling the PutObject operation: The… --- ## [The provided access key is not authorized for this operation. - Please contact support and provide this identifier to reference this issue](https://forum.serverless.com/t/the-provided-access-key-is-not-authorized-for-this-operation-please-contact-support-and-provide-this-identifier-to-reference-this-issue/20847)
**Author:** [@Johan](https://forum.serverless.com/u/Johan)\ **Replies:** 0\ **Last updated:** [December 12, 2024, 12:39am UTC](https://forum.serverless.com/t/the-provided-access-key-is-not-authorized-for-this-operation-please-contact-support-and-provide-this-identifier-to-reference-this-issue/20847 "2024-12-12T00:39:43Z")
Hi all, I have been having tremendous issues with Serverless not being able to leverage my credentials and I isolated it to a singular context. Situation: My key looks good in ~/.aws/credentials and my serverless dash… --- ## [Require API Key On Websockets API](https://forum.serverless.com/t/require-api-key-on-websockets-api/19042)
**Author:** [@nicks6853](https://forum.serverless.com/u/nicks6853)\ **Replies:** 1\ **Last updated:** [August 29, 2024, 11:00pm UTC](https://forum.serverless.com/t/require-api-key-on-websockets-api/19042 "2024-08-29T23:00:08Z")
I was wondering how one can make API Keys required on a Websockets API. Does serverless framework support that, if not, is there a way to make it required? Seems like private: true doesn’t work for websocket events. --- ## [Using default values to skip array value](https://forum.serverless.com/t/using-default-values-to-skip-array-value/17126)
**Author:** [@SebVen](https://forum.serverless.com/u/SebVen)\ **Replies:** 1\ **Last updated:** [August 16, 2024, 10:09pm UTC](https://forum.serverless.com/t/using-default-values-to-skip-array-value/17126 "2024-08-16T22:09:26Z")
This post is inspired by the following one on stackoverflow: amazon web services - Use stage parameters to skip fields in Serverless Framework - Stack Overflow In the code below, is there a particular 'default value' th… --- ## [How to access ssm variables](https://forum.serverless.com/t/how-to-access-ssm-variables/16799)
**Author:** [@sjschweber](https://forum.serverless.com/u/sjschweber)\ **Replies:** 3\ **Last updated:** [July 8, 2024, 1:41pm UTC](https://forum.serverless.com/t/how-to-access-ssm-variables/16799 "2024-07-08T13:41:45Z")
I’m writing a function on my local device and want to deploy it securely to AWS Lambda. I’ve configured a serverless.yml file and have defined environment variables for my function. I’ve defined the function as such in … --- ## [Is it possible to replace inline policy with customer managed?](https://forum.serverless.com/t/is-it-possible-to-replace-inline-policy-with-customer-managed/18810)
**Author:** [@phas13](https://forum.serverless.com/u/phas13)\ **Replies:** 6\ **Last updated:** [June 18, 2024, 5:51pm UTC](https://forum.serverless.com/t/is-it-possible-to-replace-inline-policy-with-customer-managed/18810 "2024-06-18T17:51:45Z")
Our company is trying to pass security compliance, and one of requirements is not to have inline policies attached to roles. Is it possible to replace created by default inline policy attached to role with customer manag… --- ## [IAM Role not created, Role Used has resourceTag Limitation](https://forum.serverless.com/t/iam-role-not-created-role-used-has-resourcetag-limitation/20256)
**Author:** [@gw-bcharboneau](https://forum.serverless.com/u/gw-bcharboneau)\ **Replies:** 0\ **Last updated:** [June 6, 2024, 7:41pm UTC](https://forum.serverless.com/t/iam-role-not-created-role-used-has-resourcetag-limitation/20256 "2024-06-06T19:41:39Z")
We are trying to create an IAM Role with Serverless Framework but the Role used by our CICD Process uses a Role With AdministratorAccess Policy and a Permissions boiundary that restricts iam:\*. however it allows a few ia… --- ## [CloudFormation - CREATE\_FAILED while using existing s3 bucket without \`iam:CreateRole\`](https://forum.serverless.com/t/cloudformation-create-failed-while-using-existing-s3-bucket-without-iam-createrole/9552)
**Author:** [@gkeswani92](https://forum.serverless.com/u/gkeswani92)\ **Replies:** 3\ **Last updated:** [August 3, 2023, 11:27am UTC](https://forum.serverless.com/t/cloudformation-create-failed-while-using-existing-s3-bucket-without-iam-createrole/9552 "2023-08-03T11:27:19Z")
Hi, I am trying to deploy a lambda function that gets triggered when an AVRO file is written to an existing s3 bucket. My serverless.yml configuration is as follows: service: braze-lambdas provider: name: aws runt… --- ## [Using an APIGatewayV2 Authorizer for specific endpoints](https://forum.serverless.com/t/using-an-apigatewayv2-authorizer-for-specific-endpoints/18697)
**Author:** [@fdir](https://forum.serverless.com/u/fdir)\ **Replies:** 0\ **Last updated:** [April 3, 2023, 10:56pm UTC](https://forum.serverless.com/t/using-an-apigatewayv2-authorizer-for-specific-endpoints/18697 "2023-04-03T22:56:03Z")
I am creating an API that has endpoints both secured and unsecured. I was able to add a Cognito User Pool Authorizer, but it seems to authenticate all endpoints and I cant figure out how to whitelist certain endpoints, w… --- ## [S3 create bucket policy](https://forum.serverless.com/t/s3-create-bucket-policy/5497)
**Author:** [@khinester](https://forum.serverless.com/u/khinester)\ **Replies:** 3\ **Last updated:** [October 14, 2022, 11:49pm UTC](https://forum.serverless.com/t/s3-create-bucket-policy/5497 "2022-10-14T23:49:09Z")
Hello, I would like to create a s3 bucket policy and attach a function to that, so that users are only able to add specific file types and the function is able to action on these files - so my function should have a Get… --- ## ["Lambda Security Notification" from AWS involving IAM policies – need help determining action for serverless framework](https://forum.serverless.com/t/lambda-security-notification-from-aws-involving-iam-policies-need-help-determining-action-for-serverless-framework/16660)
**Author:** [@pallpointben](https://forum.serverless.com/u/pallpointben)\ **Replies:** 3\ **Last updated:** [September 8, 2022, 9:48am UTC](https://forum.serverless.com/t/lambda-security-notification-from-aws-involving-iam-policies-need-help-determining-action-for-serverless-framework/16660 "2022-09-08T09:48:08Z")
We use the serverless framework and a week or two ago we received the message below from AWS. I haven’t seen any discussion about this anywhere, which is puzzling because it seems like it’s a policy change that would aff… --- ## [Is there any way to use separate .env for each stage in serverless framework V3?](https://forum.serverless.com/t/is-there-any-way-to-use-separate-env-for-each-stage-in-serverless-framework-v3/17499)
**Author:** [@vijayporterdev](https://forum.serverless.com/u/vijayporterdev)\ **Replies:** 0\ **Last updated:** [August 10, 2022, 11:58am UTC](https://forum.serverless.com/t/is-there-any-way-to-use-separate-env-for-each-stage-in-serverless-framework-v3/17499 "2022-08-10T11:58:43Z")
I’m in the process of migrating serverless project v2.40 to v3.21 but I’m facing issue like loading env variable to the serverless. Earlier, we’re serverless-dotenv-plugin to support each .env file each stage(eg. .env.de… --- ## [Deploy using Serverless Framework without AWS Credentials](https://forum.serverless.com/t/deploy-using-serverless-framework-without-aws-credentials/17434)
**Author:** [@gunjan](https://forum.serverless.com/u/gunjan)\ **Replies:** 0\ **Last updated:** [July 25, 2022, 6:22am UTC](https://forum.serverless.com/t/deploy-using-serverless-framework-without-aws-credentials/17434 "2022-07-25T06:22:05Z")
Hi, The scenario is to deploy AWS Lambda. API Gateway on AWS using serverless framework without using AWS Credentials. Basically, the user’s credentials, API access key etc. cannot be shared. So, can we do this by kee… --- ## [Local kafka as event source](https://forum.serverless.com/t/local-kafka-as-event-source/17346)
**Author:** [@jeusdi](https://forum.serverless.com/u/jeusdi)\ **Replies:** 0\ **Last updated:** [June 22, 2022, 5:50am UTC](https://forum.serverless.com/t/local-kafka-as-event-source/17346 "2022-06-22T05:50:17Z")
I’m trying to build a local development environment in order to make my local tests. I need to use kafka as event-source. I’ve deployed a self-managed cluster into my local environment using docker. An issue is runnin… --- ## [Private AWS credentials being shared with Serverless.com?](https://forum.serverless.com/t/private-aws-credentials-being-shared-with-serverless-com/13603)
**Author:** [@jheising](https://forum.serverless.com/u/jheising)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 2:18pm UTC](https://forum.serverless.com/t/private-aws-credentials-being-shared-with-serverless-com/13603 "2021-10-11T14:18:53Z")
I’ve been having trouble with a deployment with a serverless-component, so I’ve been trying to debug it. Stepping through the code, I actually thought I’d be able to step into the component itself and see what was going … --- ## [How to get secret from Secret Manager in serverless](https://forum.serverless.com/t/how-to-get-secret-from-secret-manager-in-serverless/15177)
**Author:** [@carlosfer02](https://forum.serverless.com/u/carlosfer02)\ **Replies:** 3\ **Last updated:** [September 16, 2021, 4:36pm UTC](https://forum.serverless.com/t/how-to-get-secret-from-secret-manager-in-serverless/15177 "2021-09-16T16:36:20Z")
I configured a secret to my RDS database. Its name is: qa/aurora I am trying to make the reference on my serverless.yml in the environment settings like this: DB: ${ssm:/aws/reference/secretsmanager/qa/aurora~true} I… --- ## [Best practices when publishing to Github: should ARNs be removed from the serverless.yml?](https://forum.serverless.com/t/best-practices-when-publishing-to-github-should-arns-be-removed-from-the-serverless-yml/14839)
**Author:** [@asker](https://forum.serverless.com/u/asker)\ **Replies:** 3\ **Last updated:** [April 30, 2021, 12:16pm UTC](https://forum.serverless.com/t/best-practices-when-publishing-to-github-should-arns-be-removed-from-the-serverless-yml/14839 "2021-04-30T12:16:14Z")
I am about to make my Github repo public and share my project with the world. That includes my serverless.yml. My serverless.yml file contains the ARNs of my layer, DynamoDB table and S3 bucket. For example: service: n… --- ## ["Sign in with apple" - any guides/templates/tutorials?](https://forum.serverless.com/t/sign-in-with-apple-any-guides-templates-tutorials/14674)
**Author:** [@jonasrk](https://forum.serverless.com/u/jonasrk)\ **Replies:** 0\ **Last updated:** [April 8, 2021, 4:03pm UTC](https://forum.serverless.com/t/sign-in-with-apple-any-guides-templates-tutorials/14674 "2021-04-08T16:03:15Z")
Hi friends, I would love to code up a full-stack app very much like I’ve learned in https://www.serverless.com/learn/courses/full-stack-application-development-on-aws/ . The only thing I would like to customize, is tha… --- ## [Desperately Seeking Guidance on Existing Infrastructure](https://forum.serverless.com/t/desperately-seeking-guidance-on-existing-infrastructure/14622)
**Author:** [@jbkc85](https://forum.serverless.com/u/jbkc85)\ **Replies:** 0\ **Last updated:** [April 2, 2021, 6:59pm UTC](https://forum.serverless.com/t/desperately-seeking-guidance-on-existing-infrastructure/14622 "2021-04-02T18:59:30Z")
Hi all, I am brand new to serverless and more specifically - serverless components. I am also on the Operation side of things, so rather than being just ‘developing’ on the code, I am also extremely concerned about the… --- ## [Google function deploy security-level=secure-always](https://forum.serverless.com/t/google-function-deploy-security-level-secure-always/14477)
**Author:** [@fhirfly](https://forum.serverless.com/u/fhirfly)\ **Replies:** 0\ **Last updated:** [March 23, 2021, 11:53pm UTC](https://forum.serverless.com/t/google-function-deploy-security-level-secure-always/14477 "2021-03-23T23:53:45Z")
This flag is documented here on function deploy through gcloud Anyone know if /how you can specify this in serverless.yaml? --- ## [Serverless app can't be deployed because of Lambda function VPC error](https://forum.serverless.com/t/serverless-app-cant-be-deployed-because-of-lambda-function-vpc-error/14332)
**Author:** [@claudiadast](https://forum.serverless.com/u/claudiadast)\ **Replies:** 1\ **Last updated:** [March 11, 2021, 9:12am UTC](https://forum.serverless.com/t/serverless-app-cant-be-deployed-because-of-lambda-function-vpc-error/14332 "2021-03-11T09:12:18Z")
I’m trying to deploy a Lambda function that can download a file from S3 to EFS upon an S3 object being uploaded to a given bucket. This is what I have for my serverless.yml file so far, but when I try to deploy it, I get… --- ## [Does Serverless, Inc ever see my AWS credentials?](https://forum.serverless.com/t/does-serverless-inc-ever-see-my-aws-credentials/9932)
**Author:** [@amacrobert-meq](https://forum.serverless.com/u/amacrobert-meq)\ **Replies:** 6\ **Last updated:** [November 25, 2020, 7:33am UTC](https://forum.serverless.com/t/does-serverless-inc-ever-see-my-aws-credentials/9932 "2020-11-25T07:33:20Z")
I’m trying to sell my company on serverless, but we handle PHI so security’s tight. Our compliance director and CTO had concerns about passing our AWS key and secret to another company. When doing a serverless deploy, d… --- ## [IAM permissions boundary support](https://forum.serverless.com/t/iam-permissions-boundary-support/6835)
**Author:** [@doanian](https://forum.serverless.com/u/doanian)\ **Replies:** 3\ **Last updated:** [August 30, 2020, 8:36pm UTC](https://forum.serverless.com/t/iam-permissions-boundary-support/6835 "2020-08-30T20:36:18Z")
Does Serverless support an easy way to add an IAM permission boundary to the lambda execution roles? I’d love to be able to specify it in the provider similar to iamRoleStatements or on a per function level. Currently I’… --- ## [Azure equivalent to iamRoleStatements](https://forum.serverless.com/t/azure-equivalent-to-iamrolestatements/6432)
**Author:** [@pcullin-ratio](https://forum.serverless.com/u/pcullin-ratio)\ **Replies:** 2\ **Last updated:** [July 31, 2020, 2:56pm UTC](https://forum.serverless.com/t/azure-equivalent-to-iamrolestatements/6432 "2020-07-31T14:56:11Z")
What is the proper approach to providing to an Azure Function granular, least-privilege access to specific Azure resources in Serverless? For AWS, this is implemented using the iamRoleStatements block in serverless.yml, … --- ## [Whitesource scan show dot-prop@4.2.0 as prototype pollution vulnerability](https://forum.serverless.com/t/whitesource-scan-show-dot-prop-4-2-0-as-prototype-pollution-vulnerability/11885)
**Author:** [@timold](https://forum.serverless.com/u/timold)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 3:21pm UTC](https://forum.serverless.com/t/whitesource-scan-show-dot-prop-4-2-0-as-prototype-pollution-vulnerability/11885 "2020-06-30T15:21:31Z")
Hi, A white source scan has identified dot-prop@4.2.0 as having a prototype pollution vulnerability. This is within update-notifier@2.5.0 which is a component you use within the serverless framework. Here is a link fr… --- ## [How to deploy a publiccly accessible function with serverless on Google Cloud Function](https://forum.serverless.com/t/how-to-deploy-a-publiccly-accessible-function-with-serverless-on-google-cloud-function/10949)
**Author:** [@Micka33](https://forum.serverless.com/u/Micka33)\ **Replies:** 4\ **Last updated:** [May 28, 2020, 1:47am UTC](https://forum.serverless.com/t/how-to-deploy-a-publiccly-accessible-function-with-serverless-on-google-cloud-function/10949 "2020-05-28T01:47:32Z")
Since I upgraded serverless, see info below, I can not deploy my GCF publicly. Before, my functions were attributed the role : Cloud Functions Invoker allUsers Your Environment Information --------------------------… [Next page](https://forum.serverless.com/tag/security/8.md?match_all_tags=true&page=1&tags%5B%5D=security)