Serverless security: the surface that remains

With function-as-a-service (Lambda, Cloud Functions) server management disappears, application security does not. The surface shifts.

The main risks

Event injection: input comes from many sources (HTTP, queues, storage); treating it as trusted leads to classic injection. Over-broad function role: if compromised, its IAM credentials become the attacker's — least privilege is critical. Dependencies: a vulnerable package in the bundle. Secrets in environment variables, readable if the function is compromised.

# the Lambda's role = the attacker's privileges after RCE
# keep it minimal: only the actions that function actually uses

Defence

Least privilege per function, secrets in a secret manager (not in env), event validation, dependency scanning, timeouts and concurrency limits against abuse, and logging/tracing (X-Ray) for detection.