A Discussion on Serverless Application Vulnerabilities

Executive Summary: This blog post categorizes security risks for serverless applications into three levels: traditional application attacks occurring within serverless functions, adaptations of traditional attacks to serverless contexts (expanded attack surface via events/APIs, misconfigurations, container implications), and vulnerabilities unique to serverless (Denial of Wallet, shared secrets, residual container data). It stresses that injection and misconfiguration remain key threats, that APIs and leaked keys are critical attack vectors, and recommends least-privilege controls, careful cloud storage access management, and improved logging/monitoring tailored to microservices.