AWS Lambda Escape — From Function to Account

There is no host to root. Each function runs in its own hardened Firecracker microVM, and breaking out of it is not on the menu. But you don't need to. Code-exec inside a Lambda hands you the function's temporary IAM credentials — and that role is the door into the whole AWS account.