Multi-Layered Security Policy Enforcement for Confidential Data in Serverless Cloud Functions

Abstract

Serverless computing has disrupted the way clouds bring customized applications to the market because it removes the need to manage the infrastructure, allowing flexible, event-based implementations. Nevertheless, this paradigm presents new security issues, particularly, how to manage and secure confidential information. Serverless functions have ephemeral, stateless, and distributed characteristics, exposing them to an elevated level of attack surfaces, misconfigurations, and privilege escalation threats. The paper offers a complex stacked policy enforcement model that protects sensitive data in the Function-as-a-Service (FaaS) computing environment, including AWS Lambda, Azure Functions, and Google Cloud Functions. The framework suggested contains five layers interconnected with each other: authentication and access control, data classification and isolation, a context-aware policy engine, runtime tracking with anomaly detection, and audit logging with compliance verification. In deployments to production and simulated attacks (Denial-Of-Service (DoS) and API injections, and data exfiltration), we show that our system can provide high mitigation rates (up to 99.1%) at low overhead (~11.2%). We also seek to apply reinforcement learning to dynamically update the policy and fit well into DevSecOp pipelines to partake in continuous protection. We also compare the performance of cold/warm starting, cross-cloud compatibility and evolution of policy over a long time. The findings emphasize the level of protection that the layered defence offers against serverless-based applications, and they also present the potential of automated policy synthesis and edge-cloud policy extension. This work provides a scalable and extensible future of safe policy-driven serverless computing