The control plane covers access control and all create, read, update, and delete operations on function code and configurations. Function Compute secures these workflows through access management, encryption in transit and at rest, and storage isolation for function metadata, code, layers, and container images.
Security responsibilities
Control-plane security divides into two categories:
| Category | Who configures it | What it covers |
|---|---|---|
| Platform-enforced protections | Function Compute (automatic) | TLS encryption in transit, AES-256 encryption at rest, storage isolation using isolated accounts, virtualization-based function isolation |
| User-configured access controls | You | RAM permissions for event source triggers, cloud service access, RAM user authorization, and cross-account authorization |
Understanding this split helps you identify which protections are already in place and which ones require your action.
Access control with RAM
Resource Access Management (RAM) governs all access to Function Compute resources. Four scenarios require explicit authorization:
Event source triggering: Create a trigger for an event source and grant it execute permissions to invoke your function.
Cloud service access: Grant your function the permissions it needs to call other Alibaba Cloud services, such as Object Storage Service (OSS), Simple Log Service (SLS), and Tablestore.
RAM user authorization: Grant RAM users specific operation permissions on functions in your account.
Cross-account authorization: Grant other Alibaba Cloud accounts operation permissions on your functions.
Metadata security
Function Compute protects function metadata with two layers of security:
Encryption in transit: All API calls and internal service communications use Transport Layer Security (TLS) 1.2 or later.
Encryption at rest: Metadata is encrypted using AES-256. Decrypted metadata is cached for up to 600 seconds.
Code and layer security
To create or update a function, upload function code directly via API or sync it from OSS. Function Compute caches the code and any associated layers in OSS under an isolated account.
During function instance initialization, Function Compute generates a temporary download URL and downloads the code and layers into the execution environment. Virtualization isolation ensures each function instance can access only its own code and configured layers.
To download code or layers, call the API, use the console, or use CLI tools after obtaining a temporary download URL with valid credentials. All transfers use TLS 1.2 or later.
Container image security
If your function uses a container image, Function Compute caches it in Container Registry under a dedicated isolated account. Only that account can download the image. During function instance initialization, Function Compute downloads the image over TLS 1.2 or later.