Learn Lambda and discover functions
Understand Lambda basics, inspect function settings, and find serverless attack paths with security tools.
Practice serverless security on AWS
AWS Lambda Hands-On Labs
Learn AWS Lambda security by working with real serverless environments. Practice discovery, exploitation, secure access, and automated response.
No credit card required
70,000+ people learn with Cybr
- Real Lambda environments
- Guided and CTF labs
- No cloud bill
Choose a featured Lambda lab
Practice AWS Lambda security in real environments
Begin with enumeration, CloudFox, an authorizer bypass, or a local file inclusion challenge. Continue with premium serverless security labs.
FreeFree beginner labIntroduction to AWS Lambda Enumeration
Find Lambda functions and inspect their settings, code, roles, and environment variables.
Open lab
FreeFree CloudFox labPentesting AWS Lambda with CloudFox
Use CloudFox to discover Lambda functions and review serverless attack paths.
Open lab
FreeFree security labAPI Gateway Lambda Authorizer Bypass
Find and exploit an authorization weakness between API Gateway and Lambda.
Open lab
FreeFree CTF labAccess Secrets Manager via Lambda Function with LFI
Exploit local file inclusion in a Lambda function to reach a stored secret.
Open lab
PremiumLambda foundationsIntroduction to AWS Lambda Functions
Learn how Lambda functions run, receive events, use roles, and connect to AWS services.
Open lab
AWS Lambda security topics
Build practical serverless security skills
Our Lambda labs cover function discovery, API security, injection flaws, secrets, data access, vulnerability findings, and automated response.
Find and exploit Lambda weaknesses
Practice common serverless attack methods against functions, APIs, secrets, databases, and storage.
- AWS Lambda Function URL Enumeration and Exploitation
- API Gateway Lambda Authorizer Bypass
- Access Secrets Manager via Lambda Function with LFI
- Access environment variables via Lambda Function with SSTI
- Exploiting Lambda SSRF to Access S3 Buckets
- Exploiting Lambda Command Injection to access DynamoDB
- Lambda SQL injection to access secrets
Detect problems and automate response
Find vulnerable functions and use event-driven services to respond to security events.
Free cheat sheets
AWS security cheat sheets for serverless applications
References for the IAM permissions, data access, activity logging, and credential security behind AWS Lambda applications.
- AWS IAM policy anatomy cheat sheet
Read role trust and permissions policies to understand what a Lambda execution role can access after a function is compromised.
- Least-privilege S3 bucket policy cheat sheet
Bucket-policy restrictions for limiting access to S3 data from applications and AWS identities.
- IAM credential exposure incident response playbook
Investigation, containment, and recovery steps for exposed or exploited AWS credentials.
- CloudTrail events and data recording cheat sheet
Compare management and data events when reviewing how to record Lambda activity and support event-driven response.
How the labs work
Practice Lambda security without using your AWS account
Cybr prepares the serverless environment for each lab. You can focus on the security task instead of account setup, billing, and cleanup.
- Step 01
Choose a Lambda lab
Start with a free lab or choose a premium security scenario.
- Step 02
Launch the environment
Get the AWS resources, access, and instructions that the lab requires.
- Step 03
Complete the scenario
Inspect, exploit, or defend the Lambda environment and review the result.
Isolated AWS training environments
Practice without changing personal or company resources. Cybr provides the lab environment and covers its AWS costs.
Before you start
AWS Lambda hands-on lab FAQ
Can I try an AWS Lambda lab for free?
Yes. Selected Lambda security labs are free. Create a free account and start without a credit card. Start a free Lambda lab
Do I need my own AWS account?
No. Cybr supplies the AWS environment and lab access. Your personal and company AWS accounts stay separate.
How much AWS Lambda experience do I need?
Beginners can start with Lambda functions and enumeration. Intermediate labs cover API weaknesses, injection, secrets, storage, databases, and response automation.
What serverless security flaws can I practice?
Labs cover authorizer bypasses, local file inclusion, server-side template injection, request forgery, command injection, and SQL injection.
Will AWS charge me for Lambda lab resources?
No. Cybr provides the AWS environment, covers its cloud costs, and removes the lab resources after your session.
Start an AWS Lambda security lab for free
Enumerate Lambda functions in a guided AWS environment, then continue through serverless attack and defense scenarios.
No credit card required