Lambda function's environment variables expose secrets misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_45
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

A function's metadata includes environment variable fields that contain small configurations that help the function execute. These variables can be accessed by any entity with the most basic read-metadata-only permissions, and cannot be encrypted. Lambda runtime makes environment variables available without passing secrets in code or environment variables. We recommend you remove secrets from unencrypted places, especially if they can be easily accessed, to reduce the risk of exposing data to third parties.

How to Fix

Resource: AWS::Lambda::Function

• Arguments: Properties.Environment.Variables

[source,go]

Type: AWS::Lambda::Function Properties: ... Environment: Variables: key1: not_a_secret

• key2: secret

---