Description

Ensure that every AWS Lambda function that has environment variables encrypts them at rest with a customer managed AWS KMS key, instead of the default AWS managed key for Lambda. Functions without environment variables are not affected.

Rationale

With the default AWS managed key, the customer has no control over the key's policy, rotation, auditing or revocation. If environment variables hold connection strings or other sensitive configuration, this weakens confidentiality and may not meet compliance requirements for customer-controlled keys. A customer managed key with automatic rotation and a restrictive key policy gives full control over who can decrypt the variables; secrets belong in AWS Secrets Manager or Parameter Store.

Impact

  • Gives full control over the encryption key used for environment variables, including key policy, rotation and audit in AWS CloudTrail

  • AWS KMS charges apply for the customer managed key and its requests

  • If the key is disabled, scheduled for deletion or its grant is removed, the function can no longer decrypt its environment variables and fails to run

  • Users who view or edit the variables in the console need permission to use the key

Default Value

Lambda always encrypts environment variables at rest. By default it uses the AWS managed key aws/lambda, and no customer managed key is configured.

Pre-Requisites

  • IAM permissions: lambda:ListFunctions, lambda:GetFunctionConfiguration and lambda:UpdateFunctionConfiguration

  • KMS permissions on the customer managed key for the user making the change: kms:DescribeKey, kms:CreateGrant and kms:Encrypt

  • A customer managed KMS key in the same region as the function, with automatic key rotation enabled and a key policy that allows its use by the intended principals

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Lambda console and select a function.

  3. Select the Configuration tab and then Environment variables.

  4. If the function has environment variables, choose Edit and expand Encryption configuration to see which key is used for encryption at rest.

  5. Repeat for each function in each region in use.

  6. If a function has environment variables and uses the default AWS managed key, follow the implementation steps.

CLI:

List each function with its KMS key and number of environment variables:

aws lambda list-functions --region <REGION> --query "Functions[].[FunctionName,KMSKeyArn,length(keys(Environment.Variables || \`{}\`))]" --output table

A function fails if it has one or more environment variables and KMSKeyArn is empty (None). Functions without environment variables pass.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Lambda console and select the function.

  3. Select the Configuration tab and then Environment variables.

  4. Choose Edit and expand Encryption configuration.

  5. Under encryption at rest, select the option to use a customer managed key and choose the key.

  6. Choose Save.

  7. Repeat for each affected function in each region in use.

CLI:

Set the customer managed key for the function's environment variables:

aws lambda update-function-configuration --region <REGION> --function-name <FUNCTION_NAME> --kms-key-arn <KMS_KEY_ARN>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Lambda console and select the function.

  3. Select the Configuration tab, then Environment variables, and choose Edit.

  4. Expand Encryption configuration, select the default AWS managed key option and choose Save.

CLI:

Revert to the default AWS managed key by setting an empty key ARN:

aws lambda update-function-configuration --region <REGION> --function-name <FUNCTION_NAME> --kms-key-arn ""

Note: do not disable or delete the customer managed key until all functions using it have been switched back, otherwise those functions fail. Rolling back removes customer control over the encryption key.

Reference