c4.10 Prefer abstract (serverless) services
Because AWS manages managed and serverless services with heavy automation, it does not forget to patch them or make the inconsistent human errors that plague self-managed infrastructure. Preferring abstract services reduces both your operational work and your attack surface.
Implementation guidance
Let AWS carry more of the responsibility
Managed and serverless (abstract) services shift more of the shared responsibility model to AWS. AWS patches and operates them with automation, avoiding the missed patches and inconsistent, error-prone manual work that affect self-managed infrastructure.
Why mature teams default to serverless
Qualified security specialists are the scarcest resource on most teams. Choosing abstract services wherever practical:
- removes the underlying servers and their maintenance from your plate,
- shrinks the attack surface you must harden, patch, and monitor,
- and lets your specialists focus on higher-value work instead of undifferentiated infrastructure toil.
Where you still run infrastructure services (such as EC2), the earlier controls apply — OS hardening, patching, anti-malware/EDR, and a golden-image pipeline.
How to validate
- Do you prefer managed/serverless services over self-managed infrastructure where practical?
- For the infrastructure services you still run, are hardening, patching, and endpoint protection in place?
- Have you reduced attack surface and operational toil by moving suitable workloads to abstract services?
Threats addressed
- Self-managed infrastructure carries a larger attack surface and depends on humans to patch and configure consistently; missed patches and misconfigurations are a common entry point that managed/serverless services largely remove.