--- title: "AWS Lambda Hands-On Labs for Serverless Security | Cybr" description: "Practice AWS Lambda security with hands-on labs. Enumerate functions, exploit serverless flaws, automate response, and start for free." url: https://cybr.com/hands-on-labs/lambda/ --- Practice serverless security on AWS # AWS Lambda Hands-On Labs Learn AWS Lambda security by working with real serverless environments. Practice discovery, exploitation, secure access, and automated response. [Start a free Lambda lab →](https://cybr.com/hands-on-labs/lab/introduction-to-aws-lambda-enumeration/) No credit card required ![Introduction to AWS Lambda enumeration hands-on lab](https://media.cybr.com/2025/06/introduction_to_aws_lambda_enumeration_banner-624x624.jpg) ![Johnny Endrihs](https://media.cybr.com/2025/12/johnny-endrihs.jpg)![Christopher](https://media.cybr.com/2023/09/christopher-krisnd.jpeg)![Rafael Martinez](https://media.cybr.com/2024/02/rafael-martinez.jpeg)![Lixin Zhang](https://media.cybr.com/2023/07/lixin-zhang.jpeg)![Karan Thakkar](https://media.cybr.com/2025/11/karan-thakkar.png) **80,000+** people learn with Cybr - Real Lambda environments - Guided and CTF labs - No cloud bill ![Cisco](https://cybr.comhttps//media.cybr.com/2026/08/cisco-light-360.png)![Verizon](https://cybr.comhttps//media.cybr.com/2026/08/verizon-light-360.png)![Toyota](https://cybr.comhttps//media.cybr.com/2026/08/toyota-light-360.png)![Check Point](https://cybr.comhttps//media.cybr.com/2026/08/checkpoint-light-360.png)![Moody’s](https://cybr.comhttps//media.cybr.com/2026/08/moodys-light-360.png)![AT&T](https://cybr.comhttps//media.cybr.com/2026/08/att-light-360.png)![Virginia Tech](https://cybr.comhttps//media.cybr.com/2026/08/virginiatech-light-360.png) Choose a featured Lambda lab ## Practice AWS Lambda security in real environments Begin with enumeration, CloudFox, an authorizer bypass, or a local file inclusion challenge. Continue with premium serverless security labs. 1. Free Free beginner lab ### Introduction to AWS Lambda Enumeration Find Lambda functions and inspect their settings, code, roles, and environment variables. Open lab [Introduction to AWS Lambda Enumeration](https://cybr.com/hands-on-labs/lab/introduction-to-aws-lambda-enumeration/) 2. Free Free CloudFox lab ### Pentesting AWS Lambda with CloudFox Use CloudFox to discover Lambda functions and review serverless attack paths. Open lab [Pentesting AWS Lambda with CloudFox](https://cybr.com/hands-on-labs/lab/pentesting-aws-lambda-with-cloudfox/) 3. Free Free security lab ### API Gateway Lambda Authorizer Bypass Find and exploit an authorization weakness between API Gateway and Lambda. Open lab [API Gateway Lambda Authorizer Bypass](https://cybr.com/hands-on-labs/lab/api-gateway-lambda-authorizer-bypass/) 4. Free Free CTF lab ### Access Secrets Manager via Lambda Function with LFI Exploit local file inclusion in a Lambda function to reach a stored secret. Open lab [Access Secrets Manager via Lambda Function with LFI](https://cybr.com/hands-on-labs/lab/access-secrets-manager-via-lambda-function-with-lfi/) 5. Premium Lambda foundations ### Introduction to AWS Lambda Functions Learn how Lambda functions run, receive events, use roles, and connect to AWS services. Open lab [Introduction to AWS Lambda Functions](https://cybr.com/hands-on-labs/lab/introduction-to-aws-lambda-functions/) [Browse the complete lab catalog](https://cybr.com/hands-on-labs/) AWS Lambda security topics ## Build practical serverless security skills Our Lambda labs cover function discovery, API security, injection flaws, secrets, data access, vulnerability findings, and automated response. ### Learn Lambda and discover functions Understand Lambda basics, inspect function settings, and find serverless attack paths with security tools. - [Introduction to AWS Lambda Functions](https://cybr.com/hands-on-labs/lab/introduction-to-aws-lambda-functions/) - [Introduction to AWS Lambda Enumeration](https://cybr.com/hands-on-labs/lab/introduction-to-aws-lambda-enumeration/) - [Pentesting AWS Lambda with CloudFox](https://cybr.com/hands-on-labs/lab/pentesting-aws-lambda-with-cloudfox/) ### Find and exploit Lambda weaknesses Practice common serverless attack methods against functions, APIs, secrets, databases, and storage. - [AWS Lambda Function URL Enumeration and Exploitation](https://cybr.com/hands-on-labs/lab/aws-lambda-function-url-enumeration-and-exploitation/) - [API Gateway Lambda Authorizer Bypass](https://cybr.com/hands-on-labs/lab/api-gateway-lambda-authorizer-bypass/) - [Access Secrets Manager via Lambda Function with LFI](https://cybr.com/hands-on-labs/lab/access-secrets-manager-via-lambda-function-with-lfi/) - [Access environment variables via Lambda Function with SSTI](https://cybr.com/hands-on-labs/lab/access-environment-variables-via-lambda-function-with-ssti/) - [Exploiting Lambda SSRF to Access S3 Buckets](https://cybr.com/hands-on-labs/lab/exploiting-lambda-ssrf-to-access-s3-buckets/) - [Exploiting Lambda Command Injection to access DynamoDB](https://cybr.com/hands-on-labs/lab/exploiting-lambda-command-injection-to-access-dynamodb/) - [Lambda SQL injection to access secrets](https://cybr.com/hands-on-labs/lab/lambda-sql-injection-to-access-secrets/) ### Detect problems and automate response Find vulnerable functions and use event-driven services to respond to security events. - [Find vulnerable Lambda Functions with Amazon Inspector](https://cybr.com/hands-on-labs/lab/amazon-inspector-sandbox/) - [Automated Security Response with EventBridge and Lambda](https://cybr.com/hands-on-labs/lab/automated-security-response-with-eventbridge-and-lambda/) Free cheat sheets ## AWS security cheat sheets for serverless applications References for the IAM permissions, data access, activity logging, and credential security behind AWS Lambda applications. - [AWS IAM policy anatomy cheat sheet](https://cybr.com/cheat-sheets/iam-policy-anatomy/) Read role trust and permissions policies to understand what a Lambda execution role can access after a function is compromised. - [Least-privilege S3 bucket policy cheat sheet](https://cybr.com/cheat-sheets/s3-least-privilege/) Bucket-policy restrictions for limiting access to S3 data from applications and AWS identities. - [IAM credential exposure incident response playbook](https://cybr.com/cheat-sheets/iam-credential-exposure/) Investigation, containment, and recovery steps for exposed or exploited AWS credentials. - [CloudTrail events and data recording cheat sheet](https://cybr.com/cheat-sheets/cloudtrail-events-data-recording/) Compare management and data events when reviewing how to record Lambda activity and support event-driven response. [Browse all cloud security cheat sheets](https://cybr.com/cheat-sheets/) How the labs work ## Practice Lambda security without using your AWS account Cybr prepares the serverless environment for each lab. You can focus on the security task instead of account setup, billing, and cleanup. 1. Step 01 ### Choose a Lambda lab Start with a free lab or choose a premium security scenario. 2. Step 02 ### Launch the environment Get the AWS resources, access, and instructions that the lab requires. 3. Step 03 ### Complete the scenario Inspect, exploit, or defend the Lambda environment and review the result. **Isolated AWS training environments** Practice without changing personal or company resources. Cybr provides the lab environment and covers its AWS costs. Build broader AWS security skills ## Connect Lambda security to the rest of AWS Lambda functions often connect to API Gateway, IAM, Amazon S3, DynamoDB, Secrets Manager, EventBridge, and Inspector. Practice those services across our AWS lab collection. [Explore AWS hands-on labs →](https://cybr.com/hands-on-labs/aws/) [View the AWS Lambda Security Labs course](https://cybr.com/courses/aws-lambda-security-labs/) Before you start ## AWS Lambda hands-on lab FAQ Can I try an AWS Lambda lab for free? Yes. Selected Lambda security labs are free. Create a free account and start without a credit card. [Start a free Lambda lab](https://cybr.com/hands-on-labs/lab/introduction-to-aws-lambda-enumeration/) Do I need my own AWS account? No. Cybr supplies the AWS environment and lab access. Your personal and company AWS accounts stay separate. How much AWS Lambda experience do I need? Beginners can start with Lambda functions and enumeration. Intermediate labs cover API weaknesses, injection, secrets, storage, databases, and response automation. What serverless security flaws can I practice? Labs cover authorizer bypasses, local file inclusion, server-side template injection, request forgery, command injection, and SQL injection. Will AWS charge me for Lambda lab resources? No. Cybr provides the AWS environment, covers its cloud costs, and removes the lab resources after your session. ## Start an AWS Lambda security lab for free Enumerate Lambda functions in a guided AWS environment, then continue through serverless attack and defense scenarios. [Start a free Lambda lab →](https://cybr.com/hands-on-labs/lab/introduction-to-aws-lambda-enumeration/) [Browse all hands-on labs](https://cybr.com/hands-on-labs/) No credit card required