[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572978-105":53,"doc-detail-572978-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","cheat-sheet-10-serverless-security-best-practices","Cheat Sheet - 10 Serverless Security Best Practices","","Cheat sheet outlining 10 actionable serverless security best practices, from tracking and patching function dependencies to applying least-privilege permissions at a fine-grained level. It emphasizes isolating function perimeters, deploying with minimal granularity, and sanitizing event inputs to prevent injection. The guide recommends using API gateways as an additional security layer, monitoring and logging function activity for visibility and alerts, and following secure coding conventions and OWASP Top 10 principles.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/cheat-sheet-10-serverless-security-best-practices/572978/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/cheat-sheet-10-serverless-security-best-practices/572978.png","ImageObject",442,249,{"name":88,"@type":89},"EvelynWrites","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-20","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",8,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"How should function dependencies be handled to improve serverless security?","Question",{"text":109,"@type":110},"Track the libraries used in each function, flag vulnerabilities continuously, and use tools such as Snyk via the CLI, GitHub integration, Serverless Framework plugin, or direct FaaS hooks.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"What does least privilege mean for serverless functions?",{"text":114,"@type":110},"Avoid globally defined roles and broad resource permissions, use fine-grained permissions per function (e.g., via Serverless Framework manifests), and enforce runtime least-privilege with security libraries and dedicated minimal-permission users for third-party services.",{"name":116,"@type":107,"acceptedAnswer":117},"How can you protect serverless applications from injection and transit attacks?",{"text":118,"@type":110},"Sanitize and validate event data as untrusted before use to prevent injection attacks, and secure data in transit by leveraging HTTPS, verifying SSL certificates, halting on verification failure, and treating third-party responses as untrusted input.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},572978,1792085634,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":9,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":4},687212989558,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","Cheat sheet: 10 Serverless Security Best Practices  \n1. Patch function dependencies  \nTrack the libraries you use in each function, flag vulnerabilities in those libraries, and monitor them continuously.  \nUse Snyk via the CLI, GitHub, Serverless Framework plugin or direct FaaS hooks.  \n2. Adopt the principle of least privilege  \nManaging granular permissions for hundreds or thousands of functions is very hard to do, but important nonetheless.  \n Avoid globally defined roles and resource access permissions for functions.  \n Minimize access rights to resources for functions using fine-grained permissions for each function with Serverless Framework manifests.  \n Enforce the runtime least-privilege principle by making use of security libraries that disable access to system resources.  \n Use dedicated users and minimalistic permissions when accessing third-party services.  \n3. Maintain isolated function perimeters  \nTreat every function as its own security perimeter to ensure that a compromise in one function doesn’t escalate to other functions and resources:  \n Do not rely on function access and invocation ordering  Sanitize function input and treat event data as untrusted  \n Adopt, mandate and re-use security libraries across your functions  \n4. Deploy functions in minimal granularity  \nDeploy functions in minimal granularity to avoid implicit global roles for all functions and bundling unnecessary code and dependencies.  \n5. Sanitize event input to avoid injection  \nThe input received by a function may originate from different data sources, which makes it complicated to track and ensure that untrusted data has been validated before use.  \nDue to the event-driven nature of serverless architecture, properly validate and sanitize data that is received through a function to avoid injection attacks.  \n6. Employ API gateways as a security buffer  \nDon’t expose functions directly to user interaction. Instead leverage your cloud providers’API gateway capabilities to add another layer of security in front of your function. API gateways can be used for:  \n Filtering input data based on request and response mapping models  \n Offloading authentication concerns from your functions core business logic  \n DDOS protection, traffic throttling and rate limiting.  \n7. Monitor and log functions  \nAudit and monitor how and what functions are accessing to ensure no illegal paths are taken, and monitor security vulnerabilities in functions:  \nCloud provider tools like AWS X-Ray and Azure Monitor help monitor resources accessed by functions such as CPU, memory, function run time, functions data flow, and alike to create a baseline, alerts and pro-active mitigation.  \nImplement verbose and safe logging of function events, and use a central logging system to gain better observability.  \nUse function tags to provide increased visibility and easier maintenance  \nUse Snyk to integrate with your cloud provider’s deployed functions and continuously monitor for security vulnerabilities in deployed code.  \n8. Follow secure coding conventions for application code  \nWith no servers to hack, attackers will shift their attention to the application layer, so take extra care to secure your code. The OWASP Top 10 is a good place to start.  \n9. Secure and verify data in transit  \nSmall functions and stateless apps lead to more use of third party services, raising the risk of those functions and apps being attacked and of MITM attacks. Be sure to:  \nLeverage [HTTPS for a secure communication medium](HTTPS for a secure communication medium)  \nVerify SSL certificates to ensure the remote identity; halt communication upon failure to verify  \nTreat responses from 3rd party services as untrusted user input  \n10. Manage secrets in secure storage  \nSensitive information can easily be leaked and out-of-date credentials are prone to rainbow table attacks if you fail to adopt proper secret management solutions.  \nDo not store secrets in application code, environment variables or in a sourc","cbCaih6rCBrZUsdt","https://ap.wps.com/l/cbCaih6rCBrZUsdt","pdf",3191896,"English","# Serverless Security Best Practices (10)\n## Patch function dependencies\n## Adopt the principle of least privilege\n## Maintain isolated function perimeters\n## Deploy functions in minimal granularity\n## Sanitize event input to avoid injection\n## Employ API gateways as a security buffer\n## Monitor and log functions\n## Follow secure coding conventions for application code\n## Secure and verify data in transit\n## Manage secrets in secure storage","[{\"question\":\"How should function dependencies be handled to improve serverless security?\",\"answer\":\"Track the libraries used in each function, flag vulnerabilities continuously, and use tools such as Snyk via the CLI, GitHub integration, Serverless Framework plugin, or direct FaaS hooks.\"},{\"question\":\"What does least privilege mean for serverless functions?\",\"answer\":\"Avoid globally defined roles and broad resource permissions, use fine-grained permissions per function (e.g., via Serverless Framework manifests), and enforce runtime least-privilege with security libraries and dedicated minimal-permission users for third-party services.\"},{\"question\":\"How can you protect serverless applications from injection and transit attacks?\",\"answer\":\"Sanitize and validate event data as untrusted before use to prevent injection attacks, and secure data in transit by leveraging HTTPS, verifying SSL certificates, halting on verification failure, and treating third-party responses as untrusted input.\"}]","Cheat Sheet - 10 Serverless Security Best Practices | PDF",1791930348]