Now that we have seen the best practices and pointers for covering the security aspects of a system, let's do a hands-on exercise to implement the security in the Greeter API that we created in Chapter 2, AWS Serverless Offerings.
To do this, we need to create a test bed by extending the current scope of the Greeter lambda function to talk to the RDS instance and execute a simple database query. With this set up, we have a simplified version of the actual LetsPoll APIs that can be looked at cross-sectionally.
The setup is as follows:
- API Gateway calls out to the Greeter lambda function
- The Greeter lambda function makes a DB call
- The database credentials are hardcoded in the lambda function
- The PostgresDB has a master user
- The Postgres RDS DB is in a public subnet