Serverless Tokens in the Cloud: Exploitation and Detections
Summary: Unit 42 Palo Alto Networks describes how serverless functions on AWS Lambda, Azure Functions and Google Cloud Run Functions carry cloud identities whose temporary tokens - IAM role credentials in AWS, managed identity tokens in Azure, service account tokens in GCP - can be exfiltrated through insecure developer code. The article walks through simulations extracting GCP service account tokens from the Instance Metadata Server at metadata.google.internal and AWS credentials such as AWS_ACCESS_KEY_ID and AWS_SESSION_TOKEN from Lambda environment variables, then using them to list buckets and act within the attached role's permissions.
Why it matters: A token pulled from a default Compute Engine service account with Editor permissions gives an attacker near-full control of the project - modify, delete or create resources across most services - and the same class of flaw turns a single SSRF or RCE in function code into credential theft.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026