Description

Ensure that the environment variables of every AWS Lambda function do not contain secrets such as API keys, passwords, access tokens or connection strings with credentials. The variable values are scanned for patterns that look like secrets, and each potential secret is reported with the name of the variable that contains it.

Rationale

Environment variable values can be read in plain text by any user or role allowed to view the function configuration, and they can also appear in logs or be exposed through the running code. An attacker who obtains these secrets can access downstream systems, move laterally and tamper with data or services. Secrets should be stored in AWS Secrets Manager or AWS Systems Manager Parameter Store and retrieved at runtime with a least-privilege execution role, with access to the function configuration restricted and secret access monitored.

Impact

  • Removes plain-text credentials from the function configuration

  • Allows secrets to be rotated centrally without changing the function configuration

  • The function code must be changed to read the secret at runtime, which adds a call to Secrets Manager or Parameter Store

  • Any secret found in a variable should be treated as exposed and rotated

Default Value

Lambda functions have no environment variables by default. Variables are encrypted at rest, but their values are shown in plain text to anyone who can view the function configuration.

Pre-Requisites

  • IAM permissions: lambda:ListFunctions, lambda:GetFunctionConfiguration, lambda:UpdateFunctionConfiguration, secretsmanager:CreateSecret and iam:PutRolePolicy

  • Access to the function's source code and deployment process

  • Agreement with the owner of each exposed credential to rotate it

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Lambda console and select Functions.

  3. Select a function, open the Configuration tab and select Environment variables.

  4. Review the values for API keys, passwords, tokens, private keys or connection strings with credentials.

  5. Repeat for each function in each region in use.

  6. If any secret is found, follow the implementation steps.

CLI:

Show the environment variables of a function:

aws lambda get-function-configuration --region <REGION> --function-name <FUNCTION_NAME> --query "Environment.Variables"

A function fails if any environment variable value looks like a secret. Functions without environment variables pass.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Secrets Manager console and store each secret value as a secret, noting its name or ARN.

  3. Open the IAM console and add a policy to the function's execution role that allows secretsmanager:GetSecretValue on those secrets only.

  4. Change the function code to read the secrets at runtime with the AWS SDK or the AWS Parameters and Secrets Lambda Extension, and deploy it.

  5. Open the AWS Lambda console, select the function, open the Configuration tab and select Environment variables.

  6. Choose Edit and choose Remove next to each variable that contains a secret. A variable may instead hold the secret name or ARN.

  7. Choose Save and test the function.

  8. Rotate the exposed credentials at their source.

  9. Repeat for each affected function in each region in use.

CLI:

The --environment option replaces all environment variables of the function, so setting it to Variables={} would also delete variables that the function still needs. List every variable to keep, leaving out only those that contain secrets:

aws lambda update-function-configuration --region <REGION> --function-name <FUNCTION_NAME> --environment "Variables={<VARIABLE_NAME>=<VARIABLE_VALUE>,SECRET_ARN=<SECRET_ARN>}"

If the function needs no environment variables at all, remove them all:

aws lambda update-function-configuration --region <REGION> --function-name <FUNCTION_NAME> --environment "Variables={}"

Backout Plan

Before making changes, save the current function configuration:

aws lambda get-function-configuration --region <REGION> --function-name <FUNCTION_NAME> > function-configuration-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Lambda console, select the function and open the Configuration tab.

  3. Select Environment variables and choose Edit.

  4. Re-add the removed variables using the values in the saved backup.

  5. Choose Save, and deploy the previous function code if it was changed.

Note: rolling back puts the secrets back in plain-text environment variables. If the credentials have already been rotated, the old values will no longer work.

Reference