Workload and Application Security (Containers, Serverless, IaC)
Domain 5: Workload and Application Security (Containers, Serverless, IaC)
This domain tests securing build and runtime for containers, serverless functions, and infrastructure as code. Expect image hygiene, Kubernetes controls, function permissions, and IaC guardrails.
Core rules
- Build minimal images from trusted bases, pin digests, run as non-root, use read-only filesystems, and scan images in CI and at runtime.
- Kubernetes: use RBAC least privilege, Pod Security Standards, admission controllers such as OPA Gatekeeper or Kyverno, and network policies. Do not rely on namespace isolation alone.
- Serverless: each function gets its own role; avoid shared overprivileged roles; set timeouts, memory limits, and reserved concurrency; validate event input.
- IaC: scan Terraform, CloudFormation, and Bicep before apply; protect state files because they contain secrets and resource metadata; detect drift.
- Supply chain: generate SBOMs, verify signatures, and pin dependencies.
Worked example
A deployment requests privileged: true and mounts the host path /var/run/docker.sock. An admission policy denies privileged pods and hostPath mounts in production namespaces. Reasoning: privileged containers can escape to the node; the Docker socket gives control of the container runtime. The fix is to remove the mount, run as non-root, and use a least-privilege service account. Scanning the image alone would not catch this runtime configuration.
Traps
- Scanning images only after deployment.
- Using the latest tag, which defeats reproducibility and pinning.
- Assuming IaC scanning blocks a merge; it only reports unless CI is configured to fail.
- Giving a serverless function wildcard permissions because 'it is only one function.'
- Committing Terraform state with plaintext secrets to version control.