# What is Serverless Security?

> Serverless security is the protection of applications built with cloud services that abstract server provisioning and operational management from the customer.

- Canonical URL: https://yellowcube.eu/glossary/serverless-security/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It covers function code, dependencies, deployment artifacts, event sources, workload identities, permissions, secrets, data, APIs, and connected managed services. Serverless workloads still execute on servers; the provider operates more of the runtime, isolation, scaling, and infrastructure layer.

Functions as a service commonly uses events to trigger short-lived code, but serverless also includes managed application components. Security shifts toward event validation, per-function authorization, service configuration, supply chains, and provider interfaces. Short execution and automatic scaling change monitoring, response, availability, and cost-abuse scenarios.

### Key points

- **Events and identity:** Authenticate invocation paths, treat event payloads and metadata as untrusted, give each function narrow permissions, and restrict downstream service and network access.
- **Code and configuration:** Review dependencies and packages, keep secrets out of code and logs, separate environments, protect delivery pipelines, and inventory functions, triggers, layers, versions, and unused endpoints.
- **Observation and resilience:** Correlate invocation, identity, API, and data events without retaining unnecessary payloads; define concurrency, timeout, retry, dead-letter, and spending controls; and test malicious and failed events.
- **Important limitation:** Serverless transfers some infrastructure operation, not application accountability. Vulnerable code, excessive permissions, unsafe events, exposed secrets, and insecure APIs remain customer risks. Provider isolation and runtime visibility can be difficult to verify, while rapid scaling, retries, or shared dependencies can amplify denial-of-service, cost, and availability impact.

### Related terms

[Cloud-native security](<https://yellowcube.eu/glossary/cloud-native-security/>) · [Application programming interface (API) security](<https://yellowcube.eu/glossary/application-programming-interface-security/>) · [Container security](<https://yellowcube.eu/glossary/container-security/>) · [Cloud workload protection platform (CWPP)](<https://yellowcube.eu/glossary/cloud-workload-protection-platform/>) · [Cloud security](<https://yellowcube.eu/glossary/cloud-security/>)

### Sources

[CNCF Cloud Native Glossary: Serverless](https://glossary.cncf.io/serverless/) · [OWASP Serverless FaaS Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Serverless_FaaS_Security_Cheat_Sheet.html) · [CNCF Cloud Native Security Whitepaper v2](https://tag-security.cncf.io/community/resources/security-whitepaper/v2/cloud-native-security-whitepaper/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.