18 Serverless Security Iam

title: IAM Security for Serverless APIs weight: 28 date: 2026-06-28 lastmod: 2026-06-28 description: Secure serverless APIs with IAM roles and policies including least privilege, resource-based policies, function-specific roles, and cross-account access management. tags: [api-development, serverless]

IAM security for serverless APIs follows least privilege principles with function-specific roles granting minimal permissions, resource-based policies for cross-service access, and condition keys for fine-grained access control.

```yaml
# serverless.yml with least privilege IAM
provider:
  name: aws
  iam:
    role:
      statements:
        # Function-specific permissions
        - Effect: Allow
          Action: dynamodb:GetItem
          Resource: arn:aws:dynamodb:*:*:table/UsersTable
          Condition:
            ForAllValues:StringEquals:
              aws:ResourceTag/Environment: ${self:provider.stage}

        - Effect: Allow
          Action: s3:GetObject
          Resource: arn:aws:s3:::myapp-uploads/*
          Condition:
            StringLike:
              s3:prefix: "uploads/*"

functions:
  createUser:
    handler: handlers/users.create
    iamRoleStatementsInherit: false  # Don't inherit provider role
    iamRoleStatements:               # Function-specific role
      - Effect: Allow
        Action: dynamodb:PutItem
        Resource: !GetAtt UsersTable.Arn

What's Next

Now learn about serverless best practices in Building Serverless APIs.