> Markdown version of [/videos/362-security-challenges-of-breaking-a-monolith?t=551](https://www.wearedevelopers.com/videos/362-security-challenges-of-breaking-a-monolith?t=551). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Challenges of Breaking A Monolith

Decomposing your monolith expands your external attack surface, yet strictly limits a vulnerability's blast radius. Discover how to map trust boundaries and confidently secure modern distributed architectures.

- **Speakers:** Reinhard Kugler
- **Event:** WeAreDevelopers LIVE
- **Published:** February 24, 2022
- **Duration:** 45:19
- **URL:** https://www.wearedevelopers.com/videos/362-security-challenges-of-breaking-a-monolith

## Summary

Moving from a monolithic architecture to microservices offers compelling benefits for scalability and reliability, especially when handling resource-intensive tasks like video transcoding. However, this transition introduces complex security paradigms across multiple distributed components. Through the lens of building a scalable video-processing application, the narrative explores the implicit risks of separating a monolith into containerized silos like APIs, message brokers, and cloud storage. Engineering teams must rigorously map trust boundaries across these decentralized services to secure cross-component interactions and defend against malicious web attacks.

Managing user authorization without centrally coupling the application to AWS identity layers requires thoughtful planning, often leveraging S3 bucket policies alongside pre-signed URLs. Adding AWS Lambda triggers provides critical, active file validation pipelines that defend backend systems against server-side request forgery or malicious storage payloads. While decomposing a monolith severely inflates the application's external attack surface and exposes teams to a dependency hell within vulnerable base container images, it simultaneously restricts a single vulnerability's blast radius. Lateral privilege escalation becomes exponentially harder in a distributed matrix monitored by Kubernetes and constrained by system-level filters like seccomp.

Ultimately, securing modern distributed architectures demands pivoting away from expectations of perfect invulnerability. Development and operations teams must instead adopt a pragmatic balance of architectural threat modeling, restricted component access, and proactive vulnerability management. By carefully analyzing trust boundaries and limiting environmental access keys, organizations can confidently scale modular systems without compromising internal network integrity.

**Keywords:** microservices security challenges, monolith application transition, container supply chain vulnerabilities, distributed system trust boundaries, AWS S3 bucket policies, pre-signed URL authorization, server-side request forgery mitigation, container privilege isolation, kubernetes lateral movement, threat modeling methodologies, cloud storage access control, JWT authentication pipelines, AWS Lambda file validation, seccomp system filters, video transcoding security

## Chapters

1. **Building a monolithic video streaming and sharing application** (00:03) — How hardware scaling limitations drive the shift from a monolithic application to distributed services.
1. **Breaking the monolith into isolated microservices and components** (07:24) — Extracting specific functions into microservices solves resource idling and performance bottlenecks.
1. **Addressing base image vulnerabilities in application containers** (09:11) — Containerizing microservices introduces supply chain risks through vulnerable dependencies in base images.
1. **Mapping trust boundaries across frontend and backend services** (11:06) — Separating frontend systems from backend message brokers reduces the attack surface for bad actors.
1. **Managing authentication and authorization for cloud storage buckets** (14:00) — Configuring explicit bucket policies ensures only authorized identities can interact with sensitive cloud storage.
1. **Generating temporary access tokens with pre-signed URLs** (20:33) — Pre-signed URLs enable temporary anonymous access but introduce risks if private signing keys leak.
1. **Distributing and securing keys across cloud container workloads** (22:43) — Distributing long-lived access keys across Kubernetes containers increases the risk of endpoint compromise.
1. **Validating untrusted storage uploads with serverless cloud functions** (23:46) — Invoking a serverless function upon file upload provides scalable input validation for untrusted assets.
1. **Exploiting media transcoders via processing vulnerabilities in containers** (26:26) — Parsing untrusted media uploads in a transcoding container risks arbitrary code execution vulnerabilities.
1. **Escalating privileges from local container exploits to infrastructure** (28:04) — Compromising a single container provides access to environmental secrets and internal infrastructure.
1. **Mitigating container escalation paths using system call filters** (30:42) — Applying seccomp profiles improves container integrity by restricting unauthorized system interactions.
1. **Evaluating the security posture of microservices versus monolithic systems** (31:34) — Microservices effectively contain security breaches by complicating privilege escalation across isolated network boundaries.
1. **Addressing audience questions on security and microservice architectures** (33:54) — Technical discussion covers artificial intelligence in log analysis and the organizational tradeoffs of architectural decisions.

## Related Moments

- [Transitioning from a monolith to a microservice architecture](https://www.wearedevelopers.com/videos/242-microservices-how-to-get-started-with-spring-boot-and-kubernetes) (from "Microservices: how to get started with Spring Boot and Kubernetes")
- [Evaluating data storage limitations and monolithic architectural challenges](https://www.wearedevelopers.com/videos/746-swapping-low-latency-data-storage-under-high-load) (from "Swapping Low Latency Data Storage Under High Load")
- [Transitioning from monolith architectures to microservices and Kubernetes](https://www.wearedevelopers.com/videos/108-get-ready-for-operations-by-pull-requests) (from "Get ready for operations by pull requests")
- [Transitioning architecture to microservices at Netflix](https://www.wearedevelopers.com/videos/482-building-a-culture-from-chaos) (from "Building a culture from chaos")
- [Shifting from monolithic architectures to microservices and containers](https://www.wearedevelopers.com/videos/405-build-ultra-fast-in-memory-database-apps-and-microservices-with-java) (from "Build ultra-fast In-Memory Database Apps and Microservices with Java ")
- [Introduction to Kubernetes security challenges and opportunities](https://www.wearedevelopers.com/videos/412-kubernetes-security-challenge-and-opportunity) (from "Kubernetes Security - Challenge and Opportunity")

## Related Articles

- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Why You Shouldn’t Build a Microservice Architecture](https://www.wearedevelopers.com/magazine/118-why-you-shouldn-t-build-a-microservice-architecture)

## Related Jobs

- [Staff Engineer, Security Engineering Partners](https://www.wearedevelopers.com/jobs/ext/1187268-staff-engineer-security-engineering-partners) at **Twilio**
- [Senior Engineer, Infrastructure Platform](https://www.wearedevelopers.com/jobs/ext/328836-senior-engineer-infrastructure-platform) at **Intercom, Inc.**
- [Security Engineer](https://www.wearedevelopers.com/jobs/ext/1574416-security-engineer) at **Twilio**
- [Senior Security Engineer, Incident Response](https://www.wearedevelopers.com/jobs/ext/1347114-senior-security-engineer-incident-response) at **Twilio**
- [Lead Cloud DevSecOps Engineer - Kubernetes](https://www.wearedevelopers.com/jobs/ext/1659167-lead-cloud-devsecops-engineer-kubernetes) at **BWI GmbH**
- [Software Engineer, Platform Engineering (L2)](https://www.wearedevelopers.com/jobs/ext/1956829-software-engineer-platform-engineering-l2) at **Twilio**