Credential Access
Lambda environment variable secret harvest
An attacker with Lambda read permissions reads every function's environment variables and extracts plaintext credentials.
Required Permissions
Description
Lambda environment variables are stored encrypted at rest but returned in plaintext to any caller with lambda:GetFunctionConfiguration. Developers routinely store database passwords, API tokens, and AWS access keys as environment variables for convenience.
The hackaws agent lists every function with lambda:ListFunctions, reads each configuration with lambda:GetFunctionConfiguration, and runs the environment values through a secret-detection pipeline. Any string that looks like a credential is extracted and queued for use.
The permissions required are read-only. No code is executed, no function is modified, and no CloudTrail write event is emitted; only Describe calls appear in the log.
Impact
Direct harvest of database credentials, API keys, and AWS access keys embedded in function environments. Each credential found extends the attacker's reach into another service or account.
Detection
Alert on bulk ListFunctions and GetFunctionConfiguration calls from a single principal in a short window. Baseline normal read volume per principal and flag spikes. Use secret-scanning tools to find and remove plaintext credentials from function environments proactively.
Mitigation
Keep secrets in Secrets Manager or SSM Parameter Store with KMS encryption, not in Lambda environment variables. Deny lambda:GetFunctionConfiguration from read-only principals that do not need function internals. Rotate any credential ever stored as a Lambda environment variable.