# SPIRE

Published articles for SPIRE.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

DevFeed: [The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](<https://devfeed.tech/articles/the-machine-with-many-faces-post-exploitation-identity-misuse-in-spiffe-spire-7753.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/>)

Author: Eviatar Garzi

Published: 2026-09-10T10:00:43Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [containers](<https://devfeed.tech/tags/containers.md>), [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [identity](<https://devfeed.tech/tags/identity.md>), [json](<https://devfeed.tech/tags/json.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [linux](<https://devfeed.tech/tags/linux.md>), [malware](<https://devfeed.tech/tags/malware.md>), [node](<https://devfeed.tech/tags/node.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [research](<https://devfeed.tech/tags/research.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [spire](<https://devfeed.tech/tags/spire.md>), [spoof](<https://devfeed.tech/tags/spoof.md>), [spoofing](<https://devfeed.tech/tags/spoofing.md>), [threat-research](<https://devfeed.tech/tags/threat-research.md>), [tool](<https://devfeed.tech/tags/tool.md>)

### AI overview

Research on a post-exploitation technique in which root access to a Kubernetes node can let an attacker spoof cgroup metadata used by SPIRE workload attestation, impersonate co-located workloads, and obtain SVIDs.

### Source excerpt

Learn how root access on a compromised K8s node allows attackers to utilize SPIFFE/SPIRE metadata to spoof and harvest co-located workload identities. The post The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE appeared first on Unit 42.

## Security Baked Into the JVM: two Subjects, one call

DevFeed: [Security Baked Into the JVM: two Subjects, one call](<https://devfeed.tech/articles/security-baked-into-the-jvm-two-subjects-one-call-18930.md>)

Original publisher: [Read original article](<https://blog.frankel.ch/security-baked-into-jvm/3/>)

Author: Peter Firmstone

Published: 2026-08-09T00:00:00Z

Content type: article

Language: en

Sources: [Nicolas Fränkel](<https://devfeed.tech/sources/nicolas-frankel.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [SPIFFE](<https://devfeed.tech/topics/spiffe.md>), [SPIRE](<https://devfeed.tech/topics/spire.md>)

Tags: [certificates](<https://devfeed.tech/tags/certificates.md>), [dirtychai](<https://devfeed.tech/tags/dirtychai.md>), [java](<https://devfeed.tech/tags/java.md>), [jgdms](<https://devfeed.tech/tags/jgdms.md>), [jini](<https://devfeed.tech/tags/jini.md>), [jvm](<https://devfeed.tech/tags/jvm.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [microservices](<https://devfeed.tech/tags/microservices.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [permission](<https://devfeed.tech/tags/permission.md>), [process](<https://devfeed.tech/tags/process.md>), [security](<https://devfeed.tech/tags/security.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [spire](<https://devfeed.tech/tags/spire.md>), [technical](<https://devfeed.tech/tags/technical.md>)

### AI overview

This article examines identity and security in the JVM through DirtyChai. It describes separate process and user identities, including SPIFFE workload credentials delivered through SPIRE and JWT/OIDC-based user identity, and explains how these identities coexist across request dispatch and privilege boundaries.

### Source excerpt

The constraint system stops a bad call before it leaves the JVM. The Safe Codebase Audit Pipeline stops bad code before a client ever loads it. What remains is identity: who is calling, and can you verify it? Most frameworks answer with a token check at the door. A filter validates a bearer token, sets a thread-local variable, and hopes that nothing downstream forgets to look at it. DirtyChai answers differently.

## Zero trust architecture for platform engineers: Securing modern developer platforms

DevFeed: [Zero trust architecture for platform engineers: Securing modern developer platforms](<https://devfeed.tech/articles/zero-trust-architecture-for-platform-engineers-securing-modern-developer-platforms-12288.md>)

Original publisher: [Read original article](<https://platformengineering.org/blog/zero-trust-architecture-for-platform-engineers-securing-modern-developer-platforms>)

Author: Ajay Chankramath

Published: 2026-07-23T05:40:01Z

Content type: article

Language: en

Sources: [Platform Engineering Blog](<https://devfeed.tech/sources/platform-engineering-blog.md>)

Topics: [Zero Trust](<https://devfeed.tech/topics/zero-trust.md>), [Security](<https://devfeed.tech/topics/security.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>), [Platform Engineering](<https://devfeed.tech/topics/platform-engineering.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Network Segmentation](<https://devfeed.tech/topics/network-segmentation.md>), [SPIFFE](<https://devfeed.tech/topics/spiffe.md>), [SPIRE](<https://devfeed.tech/topics/spire.md>)

Tags: [architecture](<https://devfeed.tech/tags/architecture.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [cloud-native](<https://devfeed.tech/tags/cloud-native.md>), [developer](<https://devfeed.tech/tags/developer.md>), [identity](<https://devfeed.tech/tags/identity.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [network-segmentation](<https://devfeed.tech/tags/network-segmentation.md>), [platform](<https://devfeed.tech/tags/platform.md>), [platform-engineering](<https://devfeed.tech/tags/platform-engineering.md>), [policy](<https://devfeed.tech/tags/policy.md>), [security](<https://devfeed.tech/tags/security.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [spire](<https://devfeed.tech/tags/spire.md>), [zero-trust](<https://devfeed.tech/tags/zero-trust.md>)

### AI overview

This article explains how zero-trust architecture secures cloud-native developer platforms. It describes continuous authentication and authorization, cryptographic service identity through SPIFFE/SPIRE, network segmentation, policy-as-code enforcement, and runtime verification for Kubernetes-based, multi-tenant environments.

### Source excerpt

Secure your cloud-native platform with Zero Trust Architecture. Explore ZTA principles, service identity (SPIFFE/SPIRE), and policy-as-code for automated, developer-friendly security

## CockroachDB Plans Native X.509 SAN Support for SPIFFE and SPIRE Integration

DevFeed: [CockroachDB Plans Native X.509 SAN Support for SPIFFE and SPIRE Integration](<https://devfeed.tech/articles/modernizing-database-authentication-cockroachdb-embraces-zero-trust-with-spiffe-and-spire-support-23827.md>)

Original publisher: [Read original article](<https://cockroachlabs.com/blog/zero-trust-database-authentication-spiffe-spire>)

Author: Sanchit Khanna,Biplav Saraf

Published: 2026-03-13T00:00:00Z

Content type: article

Language: en

Sources: [Cockroach Labs](<https://devfeed.tech/sources/cockroach-labs.md>)

Topics: [CockroachDB](<https://devfeed.tech/topics/cockroachdb.md>), [Databases](<https://devfeed.tech/topics/databases.md>), [SPIFFE](<https://devfeed.tech/topics/spiffe.md>), [SPIRE](<https://devfeed.tech/topics/spire.md>), [certificates](<https://devfeed.tech/topics/certificates.md>), [Zero Trust](<https://devfeed.tech/topics/zero-trust.md>), [Security](<https://devfeed.tech/topics/security.md>), [Microservice](<https://devfeed.tech/topics/microservice.md>)

Tags: [architectures](<https://devfeed.tech/tags/architectures.md>), [auditability](<https://devfeed.tech/tags/auditability.md>), [aws-iam](<https://devfeed.tech/tags/aws-iam.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [cockroachdb](<https://devfeed.tech/tags/cockroachdb.md>), [compliance](<https://devfeed.tech/tags/compliance.md>), [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [database](<https://devfeed.tech/tags/database.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [processor](<https://devfeed.tech/tags/processor.md>), [regex](<https://devfeed.tech/tags/regex.md>), [security](<https://devfeed.tech/tags/security.md>), [soc](<https://devfeed.tech/tags/soc.md>), [soc-2](<https://devfeed.tech/tags/soc-2.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [spire](<https://devfeed.tech/tags/spire.md>), [standards](<https://devfeed.tech/tags/standards.md>), [teams](<https://devfeed.tech/tags/teams.md>), [verification](<https://devfeed.tech/tags/verification.md>), [zero-trust](<https://devfeed.tech/tags/zero-trust.md>)

### AI overview

The article previews planned CockroachDB authentication support for Subject Alternative Name fields in X.509 certificates. It explains how SAN support is intended to enable integration with SPIFFE and SPIRE and support regex-based identity mapping for cloud-native workloads.

### Source excerpt

In the evolution of cloud-native security, identity has become the new perimeter.

## Secure Workload Identity with SPIRE and OIDC: A Guide for Kubernetes and Istio Users

DevFeed: [Secure Workload Identity with SPIRE and OIDC: A Guide for Kubernetes and Istio Users](<https://devfeed.tech/articles/secure-workload-identity-with-spire-and-oidc-a-guide-for-kubernetes-and-istio-users-29989.md>)

Original publisher: [Read original article](<https://engineering.indeedblog.com/blog/2024/07/workload-identity-with-spire-oidc-for-k8s-istio/>)

Author: Nikhil Arora

Published: 2024-07-03T15:52:26Z

Content type: tutorial

Language: en

Sources: [Indeed](<https://devfeed.tech/sources/indeed.md>)

Topics: [SPIRE](<https://devfeed.tech/topics/spire.md>), [istio](<https://devfeed.tech/topics/istio.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Zero Trust](<https://devfeed.tech/topics/zero-trust.md>), [AWS Identity and Access Management (IAM)](<https://devfeed.tech/topics/aws-identity-and-access-management-iam.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [aws-iam](<https://devfeed.tech/tags/aws-iam.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [guide](<https://devfeed.tech/tags/guide.md>), [identity](<https://devfeed.tech/tags/identity.md>), [istio](<https://devfeed.tech/tags/istio.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [spire](<https://devfeed.tech/tags/spire.md>), [unsorted](<https://devfeed.tech/tags/unsorted.md>), [zero-trust](<https://devfeed.tech/tags/zero-trust.md>)

### AI overview

This guide describes Indeed's approach to building a workload identity platform for Kubernetes and Istio using SPIRE and OIDC, with identities and access controls rooted in Zero Trust principles. It discusses credential risks, design choices, and implementation challenges for heterogeneous first-party and third-party workloads.

### Source excerpt

Goal This blog is for engineering teams, architects, and leaders responsible for defining and implementing a workload identity platform and access controls rooted in Zero Trust principles to mitigate the risks from compromised services. It is relevant for companies using Kubernetes to manage workloads, using Istio for service mesh, and aiming to define identities in [...]

## Teleport Workload Identity

DevFeed: [Teleport Workload Identity](<https://devfeed.tech/articles/teleport-workload-identity-29975.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/workload-identity/>)

Author: ben@goteleport.com (Ben Arent)

Published: 2024-04-11T00:00:00Z

Content type: article

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [SPIFFE](<https://devfeed.tech/topics/spiffe.md>), [SPIRE](<https://devfeed.tech/topics/spire.md>), [Security](<https://devfeed.tech/topics/security.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>), [Microservice](<https://devfeed.tech/topics/microservice.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [Zero Trust](<https://devfeed.tech/topics/zero-trust.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [bootstrapping](<https://devfeed.tech/tags/bootstrapping.md>), [identity](<https://devfeed.tech/tags/identity.md>), [preview](<https://devfeed.tech/tags/preview.md>), [security](<https://devfeed.tech/tags/security.md>), [services](<https://devfeed.tech/tags/services.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [spire](<https://devfeed.tech/tags/spire.md>), [tls](<https://devfeed.tech/tags/tls.md>), [x509](<https://devfeed.tech/tags/x509.md>), [zero-trust](<https://devfeed.tech/tags/zero-trust.md>)

### AI overview

An introduction to Teleport Workload Identity, a preview feature that bootstraps and issues identities to services across heterogeneous environments and organizational boundaries. It builds on SPIFFE and adds a SPIFFE workload API endpoint, SVID issuance, TPM server attestation, and AWS Roles Anywhere support.

### Source excerpt

An introduction to Teleport Workload Identity, a preview feature for bootstrapping and issuing identities to services across heterogeneous environments.

## Connecting Block Business Units with AWS API Gateway

DevFeed: [Connecting Block Business Units with AWS API Gateway](<https://devfeed.tech/articles/connecting-block-business-units-with-aws-api-gateway-15584.md>)

Original publisher: [Read original article](<https://developer.squareup.com/blog/connecting-block-business-units-with-aws-api-gateway>)

Author: Michael Weissbacher

Published: 2023-05-18T13:00:00Z

Content type: article

Language: en

Sources: [Square Corner Blog RSS Feed](<https://devfeed.tech/sources/square-corner-blog-rss-feed.md>)

Topics: [Amazon API Gateway](<https://devfeed.tech/topics/amazon-api-gateway.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Security](<https://devfeed.tech/topics/security.md>), [SPIFFE](<https://devfeed.tech/topics/spiffe.md>), [SPIRE](<https://devfeed.tech/topics/spire.md>)

Tags: [api-gateway](<https://devfeed.tech/tags/api-gateway.md>), [aws](<https://devfeed.tech/tags/aws.md>), [aws-api-gateway](<https://devfeed.tech/tags/aws-api-gateway.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [network](<https://devfeed.tech/tags/network.md>), [security](<https://devfeed.tech/tags/security.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [spire](<https://devfeed.tech/tags/spire.md>)

### AI overview

This article explains how Block integrates acquired companies with its internal service mesh using AWS API Gateway as an identity translation layer. The Farcars infrastructure maps acquisition-native identities and IAM-based SigV4 calls to Block-native mutual TLS, enabling isolated and reusable cross-mesh communication.

### Source excerpt

Secure cross-mesh communication using in-mesh bastions

## Join Chainguard at KubeCon EU in Amsterdam April 19-21!

DevFeed: [Join Chainguard at KubeCon EU in Amsterdam April 19-21!](<https://devfeed.tech/articles/join-chainguard-at-kubecon-eu-in-amsterdam-april-19-21-13131.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/join-chainguard-at-kubecon-eu-in-amsterdam-april-19-21>)

Published: 2023-04-13T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [chainguard enforce](<https://devfeed.tech/topics/chainguard-enforce.md>), [sigstore](<https://devfeed.tech/topics/sigstore.md>), [SPIRE](<https://devfeed.tech/topics/spire.md>), [eBPF](<https://devfeed.tech/topics/ebpf.md>), [observability](<https://devfeed.tech/topics/observability.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-enforce](<https://devfeed.tech/tags/chainguard-enforce.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [cloud-native](<https://devfeed.tech/tags/cloud-native.md>), [cncf](<https://devfeed.tech/tags/cncf.md>), [cves](<https://devfeed.tech/tags/cves.md>), [ebpf](<https://devfeed.tech/tags/ebpf.md>), [kubecon](<https://devfeed.tech/tags/kubecon.md>), [kubecon-eu](<https://devfeed.tech/tags/kubecon-eu.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [linux-foundation](<https://devfeed.tech/tags/linux-foundation.md>), [observability](<https://devfeed.tech/tags/observability.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [security](<https://devfeed.tech/tags/security.md>), [sigstore](<https://devfeed.tech/tags/sigstore.md>), [spire](<https://devfeed.tech/tags/spire.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>)

### AI overview

Chainguard announces its participation in KubeCon EU 2023 in Amsterdam, including booth demonstrations of the Chainguard platform and Chainguard Images. The article highlights comparisons of minimal container image size and CVE counts, Chainguard Enforce visibility into deployed software and dependencies, and conference sessions on CI/CD security on Kubernetes, SLSA, Tekton, Sigstore, SPIRE, and Falco.

### Source excerpt

Join Chainguard at KubeCon EU in Amsterdam, April 19-21, for groundbreaking insights into cloud-native technologies.

## AWS OIDC Authentication with SPIFFE

DevFeed: [AWS OIDC Authentication with SPIFFE](<https://devfeed.tech/articles/aws-oidc-authentication-with-spiffe-15540.md>)

Original publisher: [Read original article](<https://developer.squareup.com/blog/aws-oidc-authentication-with-spiffe>)

Author: Roy Xu

Published: 2021-08-26T19:00:00Z

Content type: tutorial

Language: en

Sources: [Square Corner Blog RSS Feed](<https://devfeed.tech/sources/square-corner-blog-rss-feed.md>)

Topics: [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [SPIFFE](<https://devfeed.tech/topics/spiffe.md>), [SPIRE](<https://devfeed.tech/topics/spire.md>), [Security](<https://devfeed.tech/topics/security.md>), [Secrets Management](<https://devfeed.tech/topics/secrets-management.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [datacenter](<https://devfeed.tech/topics/datacenter.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>), [Amazon Simple Queue Service (SQS)](<https://devfeed.tech/topics/amazon-simple-queue-service-sqs.md>), [migration](<https://devfeed.tech/topics/migration.md>)

Tags: [app](<https://devfeed.tech/tags/app.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [automated](<https://devfeed.tech/tags/automated.md>), [aws](<https://devfeed.tech/tags/aws.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [datacenter](<https://devfeed.tech/tags/datacenter.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [s3](<https://devfeed.tech/tags/s3.md>), [secrets-management](<https://devfeed.tech/tags/secrets-management.md>), [security](<https://devfeed.tech/tags/security.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [spire](<https://devfeed.tech/tags/spire.md>), [sqs](<https://devfeed.tech/tags/sqs.md>)

### AI overview

Square describes using SPIFFE and SPIRE's OIDC Discovery Provider to exchange SPIFFE JWTs for AWS credentials, allowing datacenter applications to assume AWS roles through an automated configuration-based process.

### Source excerpt

Easy authentication with automated AWS credentials

## Providing mTLS Identities to Lambdas

DevFeed: [Providing mTLS Identities to Lambdas](<https://devfeed.tech/articles/providing-mtls-identities-to-lambdas-15811.md>)

Original publisher: [Read original article](<https://developer.squareup.com/blog/providing-mtls-identities-to-lambdas>)

Author: Michael Weissbacher

Published: 2020-08-25T19:00:00Z

Content type: article

Language: en

Sources: [Square Corner Blog RSS Feed](<https://devfeed.tech/sources/square-corner-blog-rss-feed.md>)

Topics: [AWS Lambda](<https://devfeed.tech/topics/aws-lambda.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [SPIFFE](<https://devfeed.tech/topics/spiffe.md>), [SPIRE](<https://devfeed.tech/topics/spire.md>), [Security](<https://devfeed.tech/topics/security.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [datacenter](<https://devfeed.tech/topics/datacenter.md>), [Microservice](<https://devfeed.tech/topics/microservice.md>), [Serverless](<https://devfeed.tech/topics/serverless.md>), [AWS IAM](<https://devfeed.tech/topics/aws-iam.md>)

Tags: [audit-trail](<https://devfeed.tech/tags/audit-trail.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [aws-lambda](<https://devfeed.tech/tags/aws-lambda.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [identity](<https://devfeed.tech/tags/identity.md>), [microservices](<https://devfeed.tech/tags/microservices.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [serverless](<https://devfeed.tech/tags/serverless.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [spire](<https://devfeed.tech/tags/spire.md>), [tls](<https://devfeed.tech/tags/tls.md>)

### AI overview

Square describes a system that gives AWS Lambda applications short-lived, SPIFFE-compatible certificates for authenticated calls to microservices in its data centers. The design uses mutual TLS, AWS Private Certificate Authority, Secrets Manager, IAM policies, and advance certificate issuance to preserve security while keeping Lambda cold starts low.

### Source excerpt

Securing severless communication with our data centers