Lambda function environment variables do not contain secrets

Check ID: awslambda_function_no_secrets_in_variables
Provider: AWS
Service: awslambda
Severity: CRITICAL
Categories: secrets
Resource type: AwsLambdaFunction

What this check verifies

AWS Lambda function environment variables are analyzed for content that resembles secrets (API keys, tokens, passwords). Pattern-based detection highlights potential hardcoded credentials present in the function’s environment.

Risk

Secrets in Lambda environment variables weaken confidentiality: users with config read access, runtime introspection, or logs may obtain them. Exposure can grant access to downstream systems, enable lateral movement, and allow tampering, impacting integrity and availability.

Recommendation

Do not store secrets in environment variables or code. Use AWS Secrets Manager or Parameter Store with encryption, fetch at runtime using least privilege IAM, and prefer short-lived creds via IAM roles. Rotate keys, limit configuration read access, and apply defense in depth with logging and alerts for secret access.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws lambda update-function-configuration --region <REGION> --function-name <FUNCTION_NAME> --environment "Variables={}"

resource "aws_lambda_function" "<example_resource_name>" {
  environment {
    variables = {} # CRITICAL: remove all env vars so no secrets are present
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::Lambda::Function
    Properties:
      Environment:
        Variables: {}  # CRITICAL: clears environment variables to ensure no secrets are stored

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = awslambda_function_no_secrets_in_variables. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Lambda function code contains no hardcoded secrets Lambda function resource-based policy blocks public access

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires