Abstract: A system and method for providing whitelist functionality for use with a cloud computing environment. In accordance with an embodiment, software applications being deployed to the cloud are restricted from using certain classes or application program interfaces (APIs). During provisioning by, e.g., a Java cloud services (JCS) infrastructure, or another component of the cloud environment, an application's resources, such as its classes or API calls, can be matched against a whitelist of acceptable resources. If the application fails to be validated against the whitelist, it will not be deployed to the cloud, and the customer/user notified accordingly. In accordance with an embodiment, a whitelist functionality can be packaged within a software development kit (SDK), which customers/users can use during development of their applications, to verify that the applications will comply with, or successfully validate against the whitelist, prior to attempting to deploy the applications to the cloud.