Check provider logo

Lambda function environment variables do not contain secrets

awslambda_function_no_secrets_in_variables

Severitycritical
Serviceawslambda
by Prowler
secrets

AWS Lambda function environment variables are analyzed for content that resembles secrets (API keys, tokens, passwords). Pattern-based detection highlights potential hardcoded credentials present in the function's environment.

Risk

Secrets in Lambda environment variables weaken confidentiality: users with config read access, runtime introspection, or logs may obtain them. Exposure can grant access to downstream systems, enable lateral movement, and allow tampering, impacting integrity and availability.

Run this check with Prowler CLI

prowler aws --checks awslambda_function_no_secrets_in_variables

Run in Prowler Cloud

Recommendation

Do not store secrets in environment variables or code. Use AWS Secrets Manager or Parameter Store with encryption, fetch at runtime using least privilege IAM, and prefer short-lived creds via IAM roles.

Rotate keys, limit configuration read access, and apply defense in depth with logging and alerts for secret access.

Remediation

CLI

aws lambda update-function-configuration --region <REGION> --function-name <FUNCTION_NAME> --environment "Variables={}"

Native IAC
Resources:
  <example_resource_name>:
    Type: AWS::Lambda::Function
    Properties:
      Environment:
        Variables: {}  # CRITICAL: clears environment variables to ensure no secrets are stored
Terraform
resource "aws_lambda_function" "<example_resource_name>" {
  environment {
    variables = {} # CRITICAL: remove all env vars so no secrets are present
  }
}
Other
  1. Open the AWS Lambda console and select the function
  2. Go to Configuration > Environment variables
  3. Click Edit
  4. Delete variables that contain secrets (or remove all variables)
  5. Click Save

Source Code

Resource Type

AwsLambdaFunction

References