High-confidence secret in Lambda environment variable

Severity: Critical
Service: Secrets exposure
Check ID: SECRETS_LAMBDA_ENV_HIGH

What this check finds

A Lambda function environment variable matches a high-confidence credential pattern (AWS key, GitHub token, Stripe key, private key header, etc.). The value is readable by any IAM principal with lambda:GetFunction or lambda:ListFunctions.

Passing looks like: No secrets in Lambda environment variables.

How to fix it

Remove the secret from the environment variable. Store it in AWS Secrets Manager or SSM Parameter Store (SecureString) and fetch at runtime via SDK.

AWS CLI

aws lambda update-function-configuration --function-name FUNCTION --environment Variables={}

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to High-confidence secret in Lambda environment variable
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	IA-5 Authenticator Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.17 Authentication information

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Secrets exposure checks

All Secrets exposure checks