---
title: Serverless Compatibility Requirements
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > App and API Protection > Enabling App and API
  Protection > Compatibility Requirements > Serverless Compatibility
  Requirements
---

# Serverless Compatibility Requirements

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site). ().
{% /alert %}

{% /callout %}

App and API Protection provides serverless capability for the following platforms and libraries:



- [AWS Lambda](https://docs.datadoghq.com/security/application_security/serverless/#aws-lambda)
- [Google Cloud Run](https://docs.datadoghq.com/security/application_security/serverless/#google-cloud-run)
- [Microsoft Azure App Service](https://docs.datadoghq.com/security/application_security/serverless/#azure-app-service)



## AWS Lambda{% #aws-lambda %}

**Note**: Threat Protection through Remote Configuration is not supported. Use [Workflows](https://docs.datadoghq.com/service_management/workflows/) to block IPs in your [WAF](https://docs.datadoghq.com/security/application_security/policies/inapp_waf_rules/).

| Type   | Threat Detection |
| ------ | ---------------- |
| Java   | yes              |
| .NET   | yes              |
| Node   | yes              |
| Python | yes              |
| Ruby   | yes              |
| PHP    |
| Go     | yes              |

### Supported trigger types{% #supported-trigger-types %}

Threat Detection supports HTTP requests as function input only, as that channel has the highest likelihood of attackers exploiting a serverless application. HTTP requests typically come from AWS services such as:

- Application Load Balancer (ALB)
- API Gateway v1 (Rest API)
- API Gateway v2 (HTTP API)
- Function URL

{% alert level="info" %}
If you would like to see support added for any of the unsupported capabilities, fill out this [form](https://forms.gle/gHrxGQMEnAobukfn7) to send feedback.
{% /alert %}

### Additional language specific compatibility information{% #additional-language-specific-compatibility-information %}

{% dl %}

{% dt %}
Node.js
{% /dt %}

{% dd %}
If you are bundling using webpack or esbuild, [follow the specific bundler instructions](https://docs.datadoghq.com/serverless/guide/serverless_tracing_and_bundlers/).
{% /dd %}

{% dt %}
Python
{% /dt %}

{% dt %}
Java
{% /dt %}

{% dd %}
To fully instrument your serverless application with distributed tracing, your Java Lambda functions must use the Java 8 Corretto (`java8.al2`), Java 11 (`java11`) or Java 17 (`java17`) runtimes with at least 1024MB of memory.
{% /dd %}

{% dd %}
If you use the Datadog Lambda layers `dd-trace-java:4` (or older) and `Datadog-Extension:24` (or older), follow the instructions in [Upgrade Instrumentation for Java Lambda Functions](https://docs.datadoghq.com/serverless/guide/upgrade_java_instrumentation).
{% /dd %}

{% dt %}
Go
{% /dt %}

{% dt %}
.NET
{% /dt %}

{% /dl %}

## Google Cloud Run{% #google-cloud-run %}

{% alert level="info" %}
Google Cloud Run support for App and API Protection serverless is in Preview.
{% /alert %}

**Note**: Threat Protection through Remote Configuration is not supported. Use [Workflows](https://docs.datadoghq.com/service_management/workflows/) to block IPs in your [WAF](https://docs.datadoghq.com/security/application_security/policies/inapp_waf_rules/).

| Type   | Threat Detection |
| ------ | ---------------- |
| Java   | Preview          |
| .NET   | Preview          |
| Node   | Preview          |
| Python | Preview          |
| Ruby   | Preview          |
| PHP    |
| Go     | Preview          |

## Azure App Service{% #azure-app-service %}

Only *web applications* are supported. Azure Functions are not supported.

**Note**: Threat Protection through Remote Configuration is not supported. Use [Workflows](https://docs.datadoghq.com/service_management/workflows/) to block IPs in your [WAF](https://docs.datadoghq.com/security/application_security/policies/inapp_waf_rules/).

| Type   | OS             | Threat Detection |
| ------ | -------------- | ---------------- |
| Java   | Windows, Linux | yes              |
| .NET   | Windows, Linux | yes              |
| Node   | Linux          | yes              |
| Python | Linux          | yes              |
| Ruby   | Linux          | yes              |
| PHP    | Linux          |