# Pod security
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
  containers:
    - name: app
      image: myapp:latest
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL

# Istio authorization policy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-frontend
spec:
  selector:
    matchLabels:
      app: frontend
  action: ALLOW
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/default/sa/backend"]
      to:
        - operation:
            methods: ["GET", "POST"]

# AWS Lambda security
import json
import boto3

def lambda_handler(event, context):
    # Validate input
    if not validate_event(event):
        return {"statusCode": 400, "body": "Invalid input"}
    
    # Check permissions
    if not check_permissions(event):
        return {"statusCode": 403, "body": "Unauthorized"}
    
    # Process request
    result = process_request(event)
    
    return {"statusCode": 200, "body": json.dumps(result)}