Serverless Security in Hybrid Cloud Environments: Threat Modeling, Identity Controls, and Input Validation for Azure Functions and AWS Lambda

Abstract

Serverless computing shifts infrastructure management responsibility from the application team to the cloud provider, but this operational simplification introduces a distinct security landscape that conventional container and virtual-machine security frameworks do not adequately address. Serverless functions execute in ephemeral, provider-managed runtimes where traditional security controls — host-based intrusion detection, file integrity monitoring, long-running agent processes — cannot be installed. The attack surface shifts from infrastructure compromise to application-layer threats: injection attacks through event triggers, excessive function permissions, insecure secret handling, and denial-of-wallet attacks that exploit the pay-per-invocation pricing model to inflict financial damage.

This paper presents a comprehensive serverless security framework for hybrid cloud environments that combine Azure Functions, AWS Lambda, and on-premises Kubernetes workloads. The framework addresses: threat modeling specific to serverless architectures using the OWASP Serverless Top 10; function-level identity and least-privilege IAM policies; input validation and injection prevention at event source boundaries; secrets management using Azure Key Vault and AWS Secrets Manager with automatic rotation; network isolation using VNet/VPC integration and private endpoints; cold start security implications; and denial-of-wallet mitigation through concurrency limits, budget alerts, and anomaly detection.

The framework is validated across a production hybrid cloud platform processing 2.8 million function invocations per day. Implementation reduced the serverless-specific vulnerability count from 34 to 3 (91 percent reduction), eliminated all critical-severity findings identified in the initial OWASP Serverless Top 10 assessment, and detected two denial-of-wallet attempts within the first six months — both automatically mitigated within 4 minutes of detection. The paper contributes practical, implementation-ready guidance for organizations operating serverless workloads alongside containerized services in hybrid cloud environments.