OWASP ServerlessGoat: A Demo Vulnerable Serverless Application — Learn Serverless Security By Breaking & Defending

OWASP ServerlessGoat is a deliberately insecure realistic AWS Lambda serverless application, maintained by OWASP. You can install WebGoat, learn about the vulnerabilities, how to exploit them, and how to remediate each issue. The project also includes documentation explaining the issues and how they should be remediated with best-practices.