AWS Lambda Security Labs

Learn first-hand how attackers exploit AWS Lambda functions with real-world attack vectors and techniques. This course is entirely made up of 🧪 Hands-On Labs featuring vulnerable Lambda environments that will teach you how to identify and exploit serverless security weaknesses. Each lab deploys real AWS environments where you'll practice Lambda enumeration, exploitation, and privilege escalation techniques. The labs include CTF-style challenges that will test your skills by providing realistic scenarios for you to capture the flag. Good luck and have fun!

View Course details

Christophe · July 15, 2025

Please note that while this course is open for free enrollment, some of the Hands-On Labs do require a premium membership.

Who is it for?

Anyone interested in learning about AWS Lambda security from an offensive perspective. Red teamers and blue teamers will gain practical skills they can apply directly on the job to find serverless vulnerabilities and demonstrate real-world impact. Relevant roles include:

Cloud penetration testers
Security researchers
Serverless security engineers
Cloud Architects and Engineers
DevSecOps roles and teams

What will you learn?

AWS Lambda enumeration and reconnaissance techniques
How to identify and exploit serverless misconfigurations
Lambda-specific attack vectors including LFI, SSTI, SSRF, and command injection
Accessing sensitive resources through compromised Lambda functions
Using specialized tools like CloudFox for Lambda security testing

What makes this course different

100% 🧪 Hands-On Labs and CTF Challenges: This course is the definition of practical serverless security learning and is made up entirely of Hands-On Labs. Each section deploys real AWS Lambda environments with specific vulnerable scenarios for you to exploit and learn from. Most labs include CTF-style challenges where you’ll capture flags while exploiting realistic Lambda security weaknesses. Most training platforms don’t offer this level of hands-on AWS Lambda security labs because of the complexity and risks involved in creating safe, isolated serverless environments. This is our specialty.

About the Course

Difficulty: Beginner to Intermediate. The labs start with basic Lambda enumeration and progress to more advanced exploitation techniques, making it perfect for those getting started with serverless security testing.

Recommended pre-requisites: You should have the AWS CLI installed and basic familiarity with AWS services. Some experience with common web vulnerabilities (LFI, SSTI, SSRF, command injection) will be helpful, especially for the later challenges. If you’re completely new to AWS, we recommend starting with our Introduction to AWS Security course first.