I'm using AWS Lambda with Python 3.14 and noticed that running an operating-system command can reveal AWS access-key variables inside the function environment. I'm unsure whether these credentials are specific to my setup or whether Lambda is unintentionally exposing something sensitive. I expected Lambda to use an IAM execution role instead.
I have not attempted to use the credentials beyond observing them, since testing access outside the intended purpose could create legal or security concerns. Is this normal Lambda behavior, and what is the proper way to report it if it might still be a vulnerability?
3 Answers
The credentials belong to the assumed execution role attached to your function. They let the code access services such as storage or databases when the role allows it. This is similar to using instance-role credentials on a virtual machine: the application can read them because it needs them to make authenticated AWS API calls. Keep the role permissions as narrow as possible and avoid logging the variables.
This is normally expected. Every Lambda function runs with an IAM execution role, and AWS obtains temporary credentials for that role through STS. The access key, secret, and session token can appear in environment variables so AWS SDKs can automatically use them. They are temporary and limited to whatever permissions you assigned to the function’s execution role.
You do not need to publish commands, credentials, logs, or a reproducible exploit while investigating a suspected issue. Publicly disclosing those details could expose active credentials or make responsible validation harder. If you still believe there is a flaw beyond the normal execution-role behavior, report it privately through the provider’s official vulnerability-reporting channel.
So seeing the credentials from inside my own function does not mean Lambda is exposing them to other customers or external users?