Lab: Setup and Deploy

In this lab you will fork the vulnerable application repository, open it in a GitHub Codespace, deploy it to your AWS account, and confirm it is running.

Everything runs inside the Codespace terminal. You will not install anything on your local machine.

Fork the repository

1. Open peachycloudsecurity/very-vulnerable-serverless in your browser.
2. Click Fork in the top-right corner and complete the fork flow. Wait until GitHub opens your fork.

⚠️ Disclaimer: Training sessions may point at a different branch or fork. Always use the repository URL your instructor gives you. This guide uses the public workshop repo above.

Open in Codespace

1. Go to your fork of the repository.
2. Click the green Code button, then open the Codespaces tab.
3. Choose Create codespace on main.
4. Wait for the environment to build. First start takes one to two minutes. When the editor loads, you have a VS Code environment in the browser with an integrated terminal.

Install tools

Run these in the Codespace integrated terminal.

Install OSLS (open-source Serverless Framework):

npm install -g osls

Install the AWS CLI (downloaded in /tmp so the installer never lands in the project folder, where it would get packaged into the Lambda):

cd /tmp
curl -s "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o awscliv2.zip
unzip -q awscliv2.zip
sudo ./aws/install
cd -
aws --version

Install project dependencies (serverless plugins):

npm install

Configure AWS credentials

You need an AWS IAM user with programmatic access. Run:

aws configure

Enter your values when prompted:

AWS Access Key ID: <your-access-key>
AWS Secret Access Key: <your-secret-key>
Default region name: us-east-1
Default output format: json

Verify the credentials work:

aws sts get-caller-identity

You should see your account ID and IAM user ARN.

Deploy the application

osls deploy

This takes about 90 seconds. When it finishes, you will see output like:

endpoints:
  ANY - https://xxxxxxxxxx.execute-api.us-east-1.amazonaws.com/dev
  ANY - https://xxxxxxxxxx.execute-api.us-east-1.amazonaws.com/dev/{proxy+}

Save the endpoint URL

Run this to extract the endpoint and save it so every terminal can use it:

ENDPOINT=$(osls info --verbose 2>/dev/null | grep "ANY -" | head -1 | awk '{print $NF}' | sed 's|/{proxy+}||')
echo "export ENDPOINT=\"$ENDPOINT\"" > ~/.lab-env
source ~/.lab-env
echo "Endpoint saved: $ENDPOINT"

You should see your full API Gateway URL printed. From now on, every lab command uses $ENDPOINT.

New terminal? Run source ~/.lab-env to reload the variable.

Verify the deployment

curl -s "$ENDPOINT/"

You should see HTML output containing Very Vulnerable Serverless. If you see this, the application is live.

Open the URL in your browser to see the landing page.

Your working directory

You are already in the repository directory. All lab commands run from here. You will use cat to view source code and curl to hit endpoints.

pwd
# Should show: /workspaces/very-vulnerable-serverless

Troubleshooting

• osls deploy fails with credentials error: Run aws sts get-caller-identity to verify your AWS credentials are configured.
• 502 Bad Gateway on first request: Lambda cold starts can take a few seconds. Wait 5 seconds and try again.
• npm install -g osls permission error: Run sudo npm install -g osls.
• osls deploy fails with Unzipped size must be smaller than 262144000 bytes: The AWS CLI installer was unzipped inside the project folder. Run rm -rf aws awscliv2.zip .serverless, then osls deploy again.
• Codespace slow or stuck: Stop the Codespace from GitHub and start a new one.
• $ENDPOINT is empty in a new terminal: Run source ~/.lab-env.

Next step: What is Serverless?