Originally reported by ITPro Today. Original announcement date: April 14, 2020.
Why Serverless Development Needs Dedicated Tooling
Cloud application development has moved well beyond virtual machines and containers. Serverless — the event-driven, functions-as-a-service (FaaS) model — lets teams run code only when triggered by an event, eliminating the need to manage long-running infrastructure. The trade-offs are real: lower operational costs and greater agility, but also a fundamentally different architecture that can expose gaps in existing CI/CD pipelines and security controls.
Serverless applications are composed of many small, discrete resources stitched together. As Chase Douglas, co-founder and CTO of Stackery, explained to ITPro Today:
“With serverless, you have many different types of resources that you’re piecing together. The most common one that people talk about are functions. Even for organizations that have already started using containers and microservices, they might not have decomposed the workflow as far down as what happens in serverless, where you might have individual functions defined for each route of an API.”
Chase Douglas, Co-founder and CTO, Stackery
To address these challenges, Stackery announced a significant platform update on April 14, 2020, focused on two areas: CI/CD integration for serverless workflows and automated least-privilege security controls.
GitOps-Based CI/CD for Serverless Workloads
Modern DevOps teams rely on continuous integration and continuous deployment (CI/CD) pipelines to ship code reliably and frequently. Stackery’s update extends that model into the serverless domain using a GitOps workflow. Here is how the pipeline works:
- Code push: A developer pushes changes to their Git provider of choice — GitHub, GitLab, or Bitbucket.
- Pull request trigger: Opening a pull request in the Git provider triggers Stackery to begin a parallel sequence of automated steps.
- Source analysis: Stackery scans the source code, identifies all functions in the serverless application stack, and runs runtime-specific code-checking tools to flag security and safety issues.
- Temporary sandbox: A short-lived sandbox environment is provisioned automatically so that integration tests defined by the team can run in isolation.
- Preview deployment: A preview environment of the full deployment is spun up, giving developers and stakeholders the opportunity to evaluate changes and collaborate before merging.
“It will also provision a temporary sandbox environment just for the purposes of running integration tests that you’ve defined. Lastly, it will provision a preview environment of the deployment, giving you an opportunity to evaluate your changes or potentially collaborate with others on your team who also can play with that preview deployment.”
Chase Douglas, Co-founder and CTO, Stackery
This GitOps approach keeps the Git repository as the single source of truth for both application code and infrastructure state — a principle that aligns well with infrastructure-as-code practices already common in container-based environments.
Least-Privilege Security for Serverless Resources
Over-permissioned cloud resources are a persistent security risk. In a traditional application, a compromised component with broad IAM permissions can become a pivot point for a wider attack across an entire cloud account. Serverless architectures face the same risk when permissions are not scoped tightly.
Stackery’s platform update addresses this with automatic permission scoping. Developers build serverless applications using a visual drag-and-drop canvas to connect resources — functions, databases, queues, and so on. With the update, the platform automatically limits the permissions granted to each connection to only what is required to execute that specific function.
“So if in the worst case, there was a security vulnerability inside one of your functions and it had a mechanism to access one of your DynamoDB database tables, then the scope of that security intrusion is limited just to that one table and cannot progress further across the entire AWS account.”
Chase Douglas, Co-founder and CTO, Stackery
This principle of least privilege — granting only the minimum permissions necessary — is a well-established security practice. Applying it automatically at the platform level removes a common source of human error in serverless IAM configuration.
What Comes Next: Collaboration and Intelligent Pipelines
Looking beyond the April 2020 release, Stackery CEO Tim Zonca outlined two priority areas for the platform roadmap:
- Team collaboration at scale: Features designed to help larger engineering teams work efficiently within shared serverless environments.
- Intelligent automation: Adding analytical and decision-making capabilities to CI/CD pipelines, potentially automating more steps in the detect-test-deploy workflow.
“One of the things that we will be adding after this launch is more around helping teams quickly scale and better collaborate. Another set of capabilities that we’ve been looking at is, how can we start to add intelligence to these automation kinds of pipelines.”
Tim Zonca, CEO, Stackery
Key Takeaways
- Serverless’s fine-grained, event-driven architecture exposes gaps in standard CI/CD and security tooling designed for VMs or containers.
- Stackery’s GitOps-based pipeline automates code analysis, integration testing in sandboxed environments, and preview deployments triggered by pull requests.
- Automatic permission scoping at the resource-connection level enforces least-privilege IAM policies without requiring manual configuration.
- The platform targets AWS-based serverless workloads, with DynamoDB cited as an example resource in the security model.