title: What is the best practice for storing sensitive env vars using AWS Lambda?
body: <p>My AWS Lambda function needs to be populated with env vars that contain sensitive values, like a master db password.</p>
  
  <p>The new env vars feature of Lambda makes this super-simple. But it's a little fuzzy as to what the best practice is, or how to go about achieving it.</p>
  
  <p>In the Lambda FAQ, they state the following:</p>
  
  <blockquote>
    <p><strong>Q: Can I store sensitive information in environment variables?</strong> For
    sensitive information, such as database passwords, we recommend you
    use client-side encryption using AWS Key Management Service and store
    the resulting values as <code>cipher text</code> in your environment variable. You
    will need to include logic in your AWS Lambda function code to decrypt
    these values.</p>
  </blockquote>
  
  <p>So they're basically saying that you need to encrypt the values yourself, then input the encrypted value into your Lambda function env vars. Then you need to include logic in your function that will decrypt the value upon instantiation. In pseudo-code, it would look like so:</p>
  
  <p><strong>On Your Laptop</strong></p>
  
  <pre><code>/// Encrypt your password
  var myDbPassword = '122345';
  var encryptedDbPassword = aws.kms.encrypt(myDbPassword, 'my-lambda-env-key');
  
  /// Store it 'on' your Lambda function
  aws.lambda.env.save('DB_PASS', encryptedDbPassword);
  </code></pre>
  
  <p><br>
  <strong>In Your Lambda Function</strong></p>
  
  <p>And then in your function, you would have logic to decrypt it upon instantiation:</p>
  
  <pre><code>var myDbPassword = aws.kms.decrypt(process.env.DB_PASS, 'my-lambda-env-key');
  db.connect('someURL', myDbPassword);
  </code></pre>
  
  <p><br>
  Simple enough, but any values you input are already encrypted when you input them, and they allow you to choose which KMS key you want to use to encrypt the values, and you can create your own KMS key and use that instead of the "default" key.</p>
  
  <p>So, what's the point of encrypting the values before input? If you can tell Lambda to use your <code>my-lambda-env-key</code> key for the encryption isn't that the same as using the <code>my-lambda-env-key</code> key to encrypt the values on your laptop before sending them to Lambda?</p>