从 AWS Lambda 控制台隐藏环境变量

Question

I have some lambda functions which uses some environment variables. I understand that we can use AWS KMS to encrypt them and then from AWS console they will not be visible.

In my case using KMS is not possible so I was wondering if there is some other way, probably by restricting at IAM level so that a user should not see env variables.

I have already tried removing GetFunction and GetFunctionConfiguration from policy. It works but the problem is, user is not able to see other things because now GetFunctionConfiguration is not allowed.

Is there any fine grain permission setting which can only hide env variables from the AWS Lambda console?

Thanks in advance.

Answer 1

At the Lambda level, I'm afraid there is no way to implement some sort of RBAC for environment variable visibility within the console.

If you have access to SSM Parameter Store , this will help solve your problem.

By storing the environment variables inside SSM, you can implement IAM based access control on each parameter by the path you place them in. This will give you a centralized location to manage your parameters for your lambdas, and help minimize code changes.

How To Store Your AWS Lambda Secrets - Medium outlines a similar scenario and how to utilize SSM effectively with Lambda.

Answer 2

The short answer is no. The solution to this is, as you pointed out, to use KMS to encrypt the variable and then decrypt it in your code.

Answer 3

As an updated answer, there is now a way to achieve it:

https://aws.amazon.com/premiumsupport/knowledge-center/lambda-environment-variables-iam-access/

The idea is to use KMS with a Customer Master Key and a policy which deny KMS actions

{
    "Id": "MyCustomKey",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Deny IAM users permission to see Lambda environment variables",
            "Effect": "Deny",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::1234567890:User1DeniedAccess",
                    "arn:aws:iam::1234567890:User2DeniedAccess"
                ]
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": "*"
        }
    ]
}

This should prevent your IAM users from seeing env variables.