It covers function code, dependencies, deployment artifacts, event sources, workload identities, permissions, secrets, data, APIs, and connected managed services. Serverless workloads still execute on servers; the provider operates more of the runtime, isolation, scaling, and infrastructure layer.
Functions as a service commonly uses events to trigger short-lived code, but serverless also includes managed application components. Security shifts toward event validation, per-function authorization, service configuration, supply chains, and provider interfaces. Short execution and automatic scaling change monitoring, response, availability, and cost-abuse scenarios.
Key points
Events and identityAuthenticate invocation paths, treat event payloads and metadata as untrusted, give each function narrow permissions, and restrict downstream service and network access.
Code and configurationReview dependencies and packages, keep secrets out of code and logs, separate environments, protect delivery pipelines, and inventory functions, triggers, layers, versions, and unused endpoints.
Observation and resilienceCorrelate invocation, identity, API, and data events without retaining unnecessary payloads; define concurrency, timeout, retry, dead-letter, and spending controls; and test malicious and failed events.
Important limitationServerless transfers some infrastructure operation, not application accountability. Vulnerable code, excessive permissions, unsafe events, exposed secrets, and insecure APIs remain customer risks. Provider isolation and runtime visibility can be difficult to verify, while rapid scaling, retries, or shared dependencies can amplify denial-of-service, cost, and availability impact.