<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Serverless Security — API Reference

## AWS Lambda CLI

```bash
# List functions
aws lambda list-functions --query 'Functions[].{Name:FunctionName,Runtime:Runtime,Role:Role}'

# Get function configuration
aws lambda get-function-configuration --function-name FUNC

# Get function policy (resource-based)
aws lambda get-policy --function-name FUNC

# List function URLs
aws lambda list-function-url-configs --function-name FUNC

# List layers
aws lambda list-layers

# Get function event source mappings
aws lambda list-event-source-mappings --function-name FUNC

# Update function to use VPC
aws lambda update-function-configuration --function-name FUNC \
  --vpc-config SubnetIds=subnet-xxx,SecurityGroupIds=sg-xxx

# Set reserved concurrency
aws lambda put-function-concurrency --function-name FUNC --reserved-concurrent-executions 100
```

## Azure Functions CLI

```bash
# List function apps
az functionapp list --query '[].{name:name, runtime:siteConfig.linuxFxVersion, rg:resourceGroup}'

# Show function app settings
az functionapp config appsettings list --name APP --resource-group RG

# Show access restrictions
az functionapp config access-restriction show --name APP --resource-group RG

# Show authentication settings
az functionapp auth show --name APP --resource-group RG
```

## GCP Cloud Functions CLI

```bash
# List functions
gcloud functions list

# Describe function
gcloud functions describe FUNC --region REGION

# Get IAM policy
gcloud functions get-iam-policy FUNC --region REGION

# Set max instances
gcloud functions deploy FUNC --max-instances 100
```

## boto3 API (Lambda)

| Method | Description |
|--------|-------------|
| `lambda.list_functions()` | List all functions |
| `lambda.get_function(FunctionName=)` | Function code + config |
| `lambda.get_function_configuration(FunctionName=)` | Config only |
| `lambda.get_policy(FunctionName=)` | Resource-based policy |
| `lambda.list_function_url_configs(FunctionName=)` | Function URLs |
| `lambda.list_event_source_mappings(FunctionName=)` | Event triggers |

## OWASP Serverless Top 10

| # | Risk |
|---|------|
| 1 | Injection |
| 2 | Broken Authentication |
| 3 | Insecure Serverless Deployment Configuration |
| 4 | Over-Privileged Function Permissions |
| 5 | Inadequate Function Monitoring and Logging |
| 6 | Insecure Third-Party Dependencies |
| 7 | Insecure Application Secrets Storage |
| 8 | Denial of Service / Financial Resource Exhaustion |
| 9 | Serverless Function Execution Flow Manipulation |
| 10 | Improper Exception Handling and Verbose Error Messages |
