Lambda environment variables use a customer-managed key

Check ID: awslambda_function_env_vars_not_encrypted_with_cmk
Provider: AWS
Service: awslambda
Severity: MEDIUM
Categories: encryption
Resource type: AwsLambdaFunction

What this check verifies

AWS Lambda function environment variables are encrypted at rest using a customer-managed KMS key (CMK) rather than the default AWS-managed Lambda service key. The presence of a KMSKeyArn on the function configuration indicates CMK-based encryption is active.

Risk

Without a CMK, environment variables are encrypted with an AWS-managed key, removing customer control over rotation, auditing, and revocation. If variables contain secrets or connection strings, loss of key control weakens confidentiality and can fail compliance requirements (PCI-DSS, HIPAA, FedRAMP) that mandate customer-controlled encryption.

Recommendation

Encrypt Lambda environment variables with a customer-managed KMS key to maintain full control over key lifecycle and access.

Create a dedicated KMS key per application or per function for blast-radius isolation
Enable automatic key rotation (EnableKeyRotation: true)
Grant only the Lambda execution role decrypt access via a key policy condition on kms:ViaService
Prefer AWS Secrets Manager or SSM Parameter Store (SecureString) for secrets — environment variables should hold non-secret configuration only

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws lambda update-function-configuration —function-name <function-name> —kms-key-arn <cmk-arn>

resource "aws_kms_key" "lambda_env" {
  description             = "Lambda env var encryption key"
  enable_key_rotation     = true
  deletion_window_in_days = 30
}

resource "aws_lambda_function" "example" {
  function_name = "<example_resource_name>"
  role          = "<example_role_arn>"
  handler       = "index.handler"
  runtime       = "python3.12"
  filename      = "<example_package.zip>"
  kms_key_arn   = aws_kms_key.lambda_env.arn

  environment {
    variables = {
      MY_CONFIG = "<value>"
    }
  }
}

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: <example_resource_name>
      Role: <example_role_arn>
      Handler: index.handler
      Runtime: python3.12
      Code:
        S3Bucket: <example_code_bucket>
        S3Key: <example_code_key>
      KmsKeyArn: <cmk-arn>
      Environment:
        Variables:
          MY_CONFIG: <value>

Create or identify a KMS CMK in the same region as the function
Grant the Lambda execution role kms:Decrypt and kms:GenerateDataKey on the key
In the Lambda console go to Configuration > Environment variables > Edit
Under Encryption configuration, select your CMK
Save — Lambda re-encrypts all environment variables with the chosen key

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = awslambda_function_env_vars_not_encrypted_with_cmk. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Amazon EC2 Auto Scaling group uses an EC2 launch template Lambda function is deployed inside a VPC

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires