Containers make things a bit harder from a persistence view. There was a great CCC talk on pwning architectures which are just based on aws lambda this year [1], worth a look.

1: https://app.media.ccc.de/v/33c3-7865-gone_in_60_milliseconds