# Ensure there are no secrets in Lambda functions code

- Source: https://support.icompaas.com/support/solutions/articles/62000129506-ensure-there-are-no-secrets-in-lambda-functions-code
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [IAM Policies](https://support.icompaas.com/support/solutions/folders/62000096130)
- Last updated: 2026-06-04
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**

Secrets Manager enables you to replace hardcoded credentials in your code, including passwords, with an API call to Secrets Manager to retrieve the secret programmatically. 

AWS Lambda is a serverless compute service that runs your code in response to events and automatically manages the underlying compute resources for you. Lambda runs your code on high-availability compute infrastructure and performs all the administration of your compute resources. 

  

**Rationale:**

**Make sure data sent has no personal info or sensitive information sent to or from the Lambda functions code. For this function to work we need to make AWS Secrets Manager so that all the data can be properly traced.** 

**Impact:**

We can have a lambda functions code without any secrets. 

  

1.  Under **Resource summary**, review the services and resources that the function can access.
2.  Choose a service from the dropdown list to see permissions related to that service.![](https://support.icompaas.com/assets/kb/15beb7cfb4ebb473.png)6\. Check the attached IAM Role has secrets manager policy.

**Default value:  
**By default, lambda function and Secrets Manager are disabled. 

**Remediation:**

1.  Choose **Configuration**, and then choose **Permissions**.![](https://support.icompaas.com/assets/kb/1c3989d8ff107eeb.png)

![](https://support.icompaas.com/assets/kb/768192cf89ed2894.png)

**Pre-Requisite:**

To grant a Lambda function access to Secrets Manager, we attach an IAM policy to the function's execution role. The policy should grant permissions for all the actions the function needs to perform on the secrets. 

**Test Plan:**

**AWS Console Process  

1.  Open the [Functions page](https://console.aws.amazon.com/lambda/home#/functions "https://console.aws.amazon.com/lambda/home#/functions") of the Lambda console.
2.  Choose the name of a function.![](https://support.icompaas.com/assets/kb/a85864e421ff16c5.png)
3.  Choose **Configuration**, and then choose **Permissions**.![](https://support.icompaas.com/assets/kb/d199f288e072b26e.png)  
    

**

1.  You can add or remove permissions from a function's execution role at any time or configure your function to use a different role.
    

-   **Using AWS CLI**
    

The following command lists the lambda function details we can see the permissions of that function.

 aws lambda list-functions  
\[--master-region <value>\]

\[--function-version <value>\]

**Implementation Plan:**

-   **AWS Console Process**
    

1.  Open the [Functions page](https://console.aws.amazon.com/lambda/home#/functions "https://console.aws.amazon.com/lambda/home#/functions") of the Lambda console.
2.  Choose the name of a function.![](https://support.icompaas.com/assets/kb/cd5bcedba65b9c73.png)
3.  Under **Resource summary**, review the services and resources that the function can access.
4.  Choose a service from the dropdown list to see permissions related to that service.
5.  Select permissions to the Lambda [execution role](https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html "https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html") to be able to access secrets: `secretsmanager:GetSecretValue` and delete it.
6.  (Optional) We can delete the secret in the Secrets Manager.
7.  Open the Secrets Manager console at [https://console.aws.amazon.com/secretsmanager/](https://console.aws.amazon.com/secretsmanager/ "https://console.aws.amazon.com/secretsmanager/").
8.  In the list of secrets, choose the secret you want to delete.
9.  In the **Secret details** section, choose **Actions**, and then choose **Delete secret**.

-   **Using AWS CLI**
    

1.  The following `remove-permission` command removes permission.
    
    aws lambda remove-permission 
        --function-name <my-function> \\
    
2.  The following `delete-secret` example deletes a secret and mention the secret-id value to delete the particular secret.
    
    aws secretsmanager delete-secret 
        --secret-id <id-value> 
    
    **Backout Plan:**
    
    -   AWS Console Process
        
        1.  Open the [Functions page](https://console.aws.amazon.com/lambda/home#/functions) of the Lambda console.  
            Choose the name of a function.
            
        
        2.  Choose Configuration, and then choose Permissions.
            
        
        3.  Under Resource summary, review the services and resources that the function can access.
            
        4.  Choose a service from the dropdown list to see permissions related to that service.
            
        
        5.  Add permissions from a function's execution role or configure your function to use a different role.
            
        6.  (Optional) If you deleted the secret in the Secrets Manager, you need to cancel secret deletion.
            
        7.  Open the Secrets Manager console at [https://console.aws.amazon.com/secretsmanager/](https://console.aws.amazon.com/secretsmanager/).
            
        
        In the list of secrets, choose the secret you want to restore.
        
        If deleted secrets don't appear in your list of secrets, choose Preferences. In the Preferences dialog box, select Show disabled secrets, and then choose Save
        
        1.  On the Secret details page, choose Cancel deletion.
            
        2.  In the Cancel secret deletion dialog box, choose Cancel deletion.
            
    

  

**Using AWS CLI**

1.  The following `add-permission` grants the specified service permission to invoke a function named.
    

aws lambda add-permission 
    --function-name <my-function> 
    --action lambda:InvokeFunction 
    --principal <source arn>

2. The following `restore-secret`  restores a secret that was previously scheduled for deletion.

aws secretsmanager restore-secret \\
    --secret-id <secret id>

## **References:**

### 

-   [https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets\_lambda.html](https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets_lambda.html)

-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_roles.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html)

-   [https://docs.aws.amazon.com/cli/latest/reference/lambda/index.html](https://docs.aws.amazon.com/cli/latest/reference/lambda/index.html)

  

### **[](https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets_lambda.html)**

## [](https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets_lambda.html)

### **[](https://docs.aws.amazon.com/cli/latest/reference/lambda/index.html)**

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.