Skip to main content

05 Serverless

Serverless compute platforms (AWS Lambda, Azure Functions, Google Cloud Functions, Cloud Run, Container Apps) attack and defense reference.

Scope​

This subcategory covers the attack surface and defensive controls of function-as-a-service (FaaS) and container-based serverless platforms:

  • identity and permission models (execution roles, managed identities, service accounts)
  • event source integrations (API Gateway, S3, EventBridge, Pub/Sub, Storage triggers)
  • code and dependency supply chain of deployed functions
  • runtime isolation, network egress and metadata access
  • logging, tracing and detection of serverless abuse

It does NOT repeat generic cloud identity attacks (covered in 01 AWS, 02 Azure, 03 GCP) or Kubernetes internals (covered in 04 Kubernetes-Cloud).

Files​

#FileFormat
01Serverless FundamentalsTwo-track
02Lambda and Cloud Functions AttacksTwo-track
03Serverless Defense and DetectionTwo-track
04Container-Based ServerlessTwo-track

Format​

Two-track (Offensive / Defensive). 11 sections:

## 1. Overview
## 2. Reconnaissance / Enumeration
## 3. Common Attack Vectors
## 4. Exploitation Recipes
## 5. Post-Exploitation
## 6. Preventive Controls
## 7. Detection Controls
## 8. Verification
## 9. Certification Alignment
## 10. Production Notes
## 11. References

Certification Alignment​

  • AWS Certified Security - Specialty
  • AWS Certified Solutions Architect - Associate
  • Google Cloud Professional Cloud Security Engineer
  • Azure Security Engineer Associate
  • CompTIA Security+
  • 01 AWS
  • 02 Azure
  • 03 GCP
  • 04 Kubernetes-Cloud
  • 06 IaC

Authorized Use Only​

CAUTION

All techniques in this subcategory are for authorized security testing, CTF environments and educational purposes only. Testing cloud accounts without written authorization violates the provider terms of service and may be illegal.

References​