What it means
The provider manages servers and portions of the runtime, while the customer remains responsible for application logic, permissions, inputs, secrets, dependencies, and service configuration.
Why it matters
Short-lived execution reduces some traditional host concerns but increases reliance on identity, event sources, managed integrations, and observability.
Practical focus
- Give each function minimal permissions
- Validate every trigger and untrusted input
- Monitor invocation patterns, failures, and downstream actions
Common mistakes
- Assuming no servers means no security responsibility
- Sharing one execution role across many functions
- Logging sensitive event payloads
Certification relevance
This subject appears in or supports the following certification bodies of knowledge:
Authoritative sources
- OWASP Serverless Top 10
- AWS Well-Architected Framework
- Microsoft Azure Well-Architected Framework
- Google Cloud Well-Architected Framework
- NIST SP 800-204 — Security Strategies for Microservices-Based Application Systems
- CISA Secure by Design
- NIST SP 800-144 — Security and Privacy in Public Cloud Computing