Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Following this question (Why do we need IDS/IPS if a firewall is present?) from a few years back, I am trying to take this subject to the cloud.
Assuming that I have a fully "serverless" AWS environment consisting only of Lambdas and Fargate based ECS containers running HTTPS services, what benefit would I get from installing an IDS/IPS gateway?
Yes, an IDS/IPS is still beneficial in a serverless environment if you want to detect potential intrusion/misuse. I can't speak to SNORT or other 3rd party solutions because I haven't used them in the cloud. I have used AWS GuardDuty as an IDS solution.
There are other non-server related security interests that can occur such as S3 data exfiltration, account compromise, unusual network traffic volume, etc. that an IDS would alert on. It's important to pay attention to these as they could be indicators of a far worse situation.
In the end, it depends on your risk analysis and risk acceptance when making a decision if an IDS/IPS in a serverless environment provides a benefit.
References
GuardDuty FAQ's
GuardDuty Independent Security Review
