Serverless Tokens in the Cloud: Exploitation and Detections

This article examines how serverless functions in AWS, Azure, and GCP authenticate using temporary tokens and how insecure code or misconfigurations (e.g., SSRF/RCE) can enable token exfiltration and abuse. It demonstrates simulated attacks to extract credentials from metadata services or environment variables, then outlines detection methods (e.g., identifying serverless identities, user-agent anomalies, ASN mismatches) and prevention strategies such as least privilege, IMDS protections, and rigorous input validation. The guidance focuses on understanding and mitigating token theft risks in serverless environments rather than documenting a specific incident.