AWS Lambda Env Var Encryption

Ensure encryption in transit is enabled for Lambda environment variables

Description

As you can set your own environmental variables for Lambda it is important to also encrypt them for in transit protection.

Rationale

Lambda environment variables should be encrypted in transit for client-side protection as they can store sensitive information.

Impact

Enabling encryption in transit adds encryption overhead and may require updates to Lambda function code to decrypt environment variables at runtime.

Audit Procedure

Using AWS Console

1. Login to the AWS Console using https://console.aws.amazon.com/lambda/.
2. In the left column, under AWS Lambda, click Functions.
3. Under Function name click on the name of the function that you want to review
4. Click the Configuration tab
5. In the left column, click Environment variables.
6. In the Environment variables section, click Edit
7. On the Edit environment variables page, review the Values. If they are a long value that resembles this: AQICAHhxbKJYcFAU16CbU4IVpzi5CwK Encryption is in place for that Key. If the value is in plain text refer to the remediation below.
8. Repeat steps 2 - 7 for each Lambda function available in the current AWS region.
9. Repeat this Audit for all the other AWS regions.

Using AWS CLI

1. Run aws lambda list-functions

aws lambda list-functions --output table --query "Functions[*].FunctionName"

This command will provide a table titled ListFunctions

2. Run aws lambda get-function

aws lambda get-function --function-name "name_of_function" --query "Configuration.Environment"

This will provide an output of the environment variables created for that function.

3. Review the Values in the table. If they contain a long value that resembles this: AQICAHhxbKJYcFAU16CbU4IVpzi5CwK. Encryption is in place for that Key. If the value is in plain text refer to the remediation below.
4. Repeat steps 1 - 3 for each Lambda function listed in the current region.
5. Repeat this Audit for all the other AWS regions.

Expected Result

All Lambda function environment variable values are encrypted in transit (values appear as encrypted ciphertext rather than plain text).

Remediation

Using AWS Console

1. Login to the AWS Console using https://console.aws.amazon.com/lambda/.
2. In the left column, under AWS Lambda, click Functions.
3. Under Function name click on the name of the function that you want to review
4. Click the Configuration tab
5. In the left column, click Environment variables.
6. In the Environment variables section, click Edit
7. Click the check box for Enable helpers for encryption in transit
8. Click the Encrypt option for all the variable that need to be encrypted.
9. Repeat steps 2 - 8 for each Lambda function identified in the Audit within the current AWS region.
10. Repeat this remediation for all the other AWS regions.

Using AWS CLI

N/A - This control is Console-based remediation only.

Default Value

Lambda environment variables are encrypted at rest by default using AWS managed keys, but encryption in transit (client-side encryption) is not enabled by default.

References

1. https://docs.aws.amazon.com/lambda/latest/dg/welcome.html

CIS Controls

Profile

Level 1 | Manual