AWS Lambda lets me execute a piece of code on a random Linux machine it provides to me, whenever I need to run my code.
What is stopping me from executing OS level commands that let me take over the machine?
Simply, the environment within which you are executing your commands is sandboxed and is unable to affect the host OS or other users' commands. Unless there's a vulnerability, of course. From https://aws.amazon.com/lambda/faqs/:
Q: Can I access the infrastructure that AWS Lambda runs on?
No. AWS Lambda operates the compute infrastructure on your behalf, allowing it to perform health checks, apply security patches, and do other routine maintenance.
Q: How does AWS Lambda isolate my code?
Each AWS Lambda function runs in its own isolated environment, with its own resources and file system view. AWS Lambda uses the same techniques as Amazon EC2 to provide security and separation at the infrastructure and execution levels.
AWS Lambda is powered by FireCracker, a micro-vm technology that basically sandboxes your code from the actual underlying machine, and other users' functions. You can read more about FireCracker here: https://firecracker-microvm.github.io/