Segurança em computação serverless: estudo de caso no projeto "pense bem".

Abstract

This work presents a security analysis applied to the serverless model in cloud-based applications, using the back-end of the educational platform Pense Bem as a case study. The objective was to identify vulnerabilities associated with this model, analyze their manifestation in the application architecture, and experimentally validate risks related to function isolation, permission control, monitoring, auditing, and distributed traceability. The methodology involved a literature review, analysis of technical reports, mapping of the system architecture, identification of critical assets, and execution of experimental tests on selected routes and services. The results demonstrated the reuse of Lambda execution environments across invocations, persistence of files in the temporary /tmp directory, recurrence of warm starts under load, excessive IAM permissions, and observability limitations, such as the absence of configured access logs, lack of correlation identifiers, absence of persistent auditing in DynamoDB, and low log standardization. Thus, the study shows that security in serverless architectures depends not only on the resources provided by the cloud provider, but also on appropriate implementation, configuration, and monitoring decisions.