AWS Lambda encryption settings environmental variable is not set properly misconfiguration detected

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_173
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

This rule checks the encryption settings for environment variables in AWS Lambda functions. It's essential to use a KMS key for encrypting environment variables to protect sensitive data. If environment variables are provided, a KMS key must be specified. This rule checks whether the kms_key_arn is set when environment variables are used in a Lambda function.

How to Fix

To fix this issue, ensure that when environment variables are specified in the AWS::Lambda::Function or AWS::Serverless::Function resource, the KmsKeyArn property is also set to a valid KMS key ARN.

Example for AWS Lambda Function:

Example for AWS Serverless Function: [source,go]

{ "Resources": { "MyLambdaFunction": { "Type": "AWS::Lambda::Function", "Properties": { ... "Environment": { "Variables": { "EXAMPLE_VAR": "example-value" } },

• "KmsKeyArn": "arn:aws:kms:us-west-2:123456789012:key/example-key-arn", ... } } } }

---

Resources: MyServerlessFunction: Type: AWS::Serverless::Function Properties: ... Environment: Variables: EXAMPLE_VAR: example-value

• KmsKeyArn: arn:aws:kms:us-west-2:123456789012:key/example-key-arn

---