Serverless removes servers from your patch list. It does not remove permissions, input validation or downstream trust.
The execution role
Each function runs with an identity. That identity determines what it can read, write and invoke.
- Give each function its own role.
- Grant only the resources and actions it needs.
- Avoid a shared "deploy" role with broad access.
- Review role trust and permissions like any other identity.
Event trust
Function input can come from:
- an HTTP request;
- an object upload;
- a queue message;
- another service's event;
- a scheduled trigger.
Treat the payload as untrusted unless the source is authenticated and validated. An event can carry attacker-controlled paths, URLs or data.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.