AWS

Use CLI with leaked credentials:

$ export AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=... AWS_SESSION_TOKEN=...
$ aws sts get-caller-identity

Then refer to https://github.com/andresriancho/enumerate-iam/

Get default subnets for a region:

$ aws ec2 describe-subnets --region us-west-1

Lambda

Runtime API: http://localhost:9001/2018-06-01/runtime/invocation/next

Doc: https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html#runtimes-api-next