On-premises environments rely on perimeter defences and direct infrastructure control. They use mechanisms such as Kerberos, LDAP and (mutual TLS) for authentication. Private clouds (e.g. OpenShift) retain this model while adding virtualisation layers. In public clouds authentication shifts from network-based trust to request signing — AWS Signature Version 4 (SigV4) authenticates every API call using cryptographic signatures, rather than relying on firewall placement.
Serverless computing shifts this boundary further still: providers manage the runtime, operating system, and scaling, while developers are responsible for code, IAM policies, and data security. Each model redefines where ‘the firewall’ exists and who controls it.
This session will examine how these security models affect Java application design. Topics include: Infrastructure as Code (IaC) and Identity and Access Management (IAM) roles for serverless Java functions; using OIDC authentication, applying least-privilege principles in managed service configurations; and maintaining consistent authentication patterns across hybrid deployments.
Your questions are very welcome and will be given the highest priority.