AWS Lambda Function Sensitive Environment Variables

[FrediWeber]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Sensitive information is sometimes provided as an environment variable to an AWS Lambda function. When we provide the secret as an environment variable with Terraform, the plan and apply step will output these values as plain text.
We suggest that a possibility is added, to specify sensitive environment variables which will not be printed out by Terraform. We futher suggest to use the existing "sensitive" function from Terraform to accomplish this goal.

New or Affected Resource(s)

• aws_lambda_function

Potential Terraform Configuration

With backward compatibility

resource "aws_lambda_function" "test_lambda" {
  filename      = "lambda_function_payload.zip"
  function_name = "lambda_function_name"
  role          = "${aws_iam_role.iam_for_lambda.arn}"
  handler       = "exports.test"
  runtime = "nodejs8.10"

  environment {
    sensitive_variables = {
      password = "SECRET"
    }
    variables = {
      foo = "bar"
    }
  }
}

Without backward compatibility

resource "aws_lambda_function" "test_lambda" {
  filename      = "lambda_function_payload.zip"
  function_name = "lambda_function_name"
  role          = "${aws_iam_role.iam_for_lambda.arn}"
  handler       = "exports.test"
  runtime = "nodejs8.10"

  environment {
    variables = [
      {
        key = "foo"
        value = "bar"
        sensitive = false
      },
      {
        key = "password"
        value = "SECRET"
        sensitive = true
      }
    ]
  }
}

[GrantBirki]

I just stumbled across this thread. It appears a very solid work around is current available in later versions of Terraform. You can see the merged pull request here where this is now supported 😃

You can do something link so to hide the output of a env var which you pass into your Lambda function:

variable "SOME_VAR_HERE" {
  ...
  sensitive=true
}

Hope this helps!

[zhelding]

As I discussed in my response to PR #11614, the use case discussed here is now covered by the sensitive function introduced by Terraform v0.15.

(https://www.terraform.io/docs/language/functions/sensitive.html)

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.