# Ensure Lambda Function Environment Variables are Encrypted with a Customer-Managed KMS Key

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890021927402-ensure-lambda-function-environment-variables-are-encrypted-with-a-customer-managed-kms-key
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Lambda function environment variables are encrypted using a customer-managed AWS KMS key, rather than relying solely on the AWS-managed default key, to give the organization direct control over the key protecting sensitive configuration values.

**Rationale**

Lambda automatically encrypts environment variables at rest using an AWS-managed KMS key by default, but this does not allow the organization to control key rotation, restrict which principals can decrypt the values, or audit key usage with the same granularity as a customer-managed key. Using a customer-managed KMS key for environment variable encryption provides greater control over access to and auditability of the underlying encryption key, which is important when environment variables carry sensitive configuration.

**Impact**

-   Provides organizational control over the encryption key protecting sensitive environment variable values
    
-   Enables detailed key usage auditing via CloudTrail and fine-grained key policy control
    
-   Adds a dependency on key availability; the function will fail to update or invoke if the KMS key is disabled or its policy is misconfigured
    

**Default Value**

By default, Lambda encrypts environment variables using an AWS-managed KMS key (aws/lambda); a customer-managed key must be explicitly selected.

**Pre-Requisites**

-   A Cloud KMS/AWS KMS customer-managed key with a key policy granting the Lambda execution role and any relevant administrators the required permissions
    
-   IAM permissions to update Lambda function configuration (lambda:UpdateFunctionConfiguration) and to use the KMS key (kms:Encrypt, kms:Decrypt, kms:GenerateDataKey)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS Lambda and select the function to review.
    
3.  Open the Configuration tab, then Environment variables.
    
4.  Review the Encryption configuration section.
    
5.  Verify that a customer-managed KMS key is selected rather than the default AWS-managed key.
    
6.  If the default AWS-managed key is in use, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS KMS and create a customer-managed key (or identify an existing one), ensuring its key policy grants the Lambda function's execution role kms:Decrypt permission.
    
3.  Navigate to AWS Lambda and select the function to update.
    
4.  Open the Configuration tab, then Environment variables, and select Edit.
    
5.  Under Encryption configuration, select Use a customer master key and choose the key created above.
    
6.  Save the configuration.
    
7.  Test the function to confirm it can still read its environment variables correctly.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS Lambda and select the affected function.
    
3.  Open the Configuration tab, then Environment variables, and select Edit.
    
4.  Under Encryption configuration, select the default AWS-managed key (aws/lambda).
    
5.  Save the configuration.
    

**Reference**

-   [https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.