AI
How Lambda Container Reuse Caused a Tenant Data Leak
A developer wrote Lambda functions to extract data from a database, process it, and send reports to customers. The function ran across multiple tenants via a scheduler. As the company grew, processing time stretched toward Lambda’s 5-minute timeout. When the function exceeded that limit, cleanup code never ran. The next invocation found leftover data from the previous tenant. On a Monday morning, a customer called asking why they received someone else’s data.
Why Serverless Needs Its Own Risk Framework
A Lambda function can receive input from an API Gateway, an S3 bucket, or dozens of other cloud events. That attack surface is far wider than a standard web app with one external endpoint. Event injection becomes a distinct threat class. The environment is also ephemeral, which reduces persistent malware risk but creates cleanup failures like the tenant leak above. The shared responsibility model still leaves data, application logic, monitoring, and logging entirely on the customer.
The Risks Developers Overlook in Lambda Functions
The 2017 list covers broken access control, security misconfiguration, insufficient logging, and event injection. In practice, Lambda developers set timeouts at 15 minutes without understanding the consequence. That enables deny-of-wallet: repeated hits cause AWS to auto-scale concurrent instances and the bill spikes. Least-privilege IAM is equally neglected. Many developers assign star permissions to Lambda execution roles, so a single compromised function can reach every service in the account.
Refreshing a List That Is Nearly Eight Years Old
The OWASP Serverless Top 10 was created in 2017 and has not been updated since. Cloud providers have added Lambda URL endpoints, new event sources, and changed how container reuse works. The team is collecting issues from organizations starting October, running polls and prioritization, then sharing preliminary results for community feedback. V2 targets OWASP AppSec 2025 in Washington DC. With AI agents actively scanning environments, Melamed warned breaches happen in far less time than it takes to detect them.
Q&A
What tools exist to protect against serverless security threats? Few tools target serverless specifically. SCA tools cover outdated libraries, CSPM tools like Prowler catch misconfiguration, and CloudWatch or Lumigo handle observability. Least-privilege role carving lacks a strong open-source solution; GenAI may help analyze code and generate minimal IAM policies. ▶ Watch (23:05)
Which cloud platforms beyond AWS carry the most serverless risk? AWS leads in serverless maturity and available guidance, but the risk list applies to all providers. Core issues like event injection are platform-agnostic, though feature differences such as Lambda URLs create platform-specific attack surface. ▶ Watch (25:55)
Notable Quotes
you can be breached in way way less time David Melamed · ▶ Watch (11:29)
one of thing in security that is important is not whether or not you will David Melamed · ▶ Watch (16:01)
Key Takeaways
- Lambda container reuse means ephemeral is not equivalent to clean; always run cleanup before timeout.
- Deny-of-wallet is a real serverless risk: long timeouts and high concurrency spike costs fast.
- The OWASP Serverless Top 10 from 2017 is getting a community-driven V2 update targeting OWASP 2025.
About the Speakers
David Melamed is the CTO and Co-Founder of Jit, the open ASPM for Cloud-Native applications. With over 15 years of experience in cybersecurity and cloud computing, he holds a PhD in Bioinformatics from Paris XI University and serves as an AWS Community Builder focused on serverless security.
Aruneesh Salhotra is a technologist and servant leader with expertise across cybersecurity, DevSecOps, AI, and Business Continuity. He works as a fractional CISO, runs independent research groups focused on generative AI and quantum computing, and contributes as a speaker and panelist across the industry.