I'm investigating a possible security issue in an AWS Lambda function running Python 3.1.4. When using an OS command, I noticed what appear to be AWS access keys in the Lambda environment or filesystem. I expected Lambda to use an IAM execution role instead, so I'm unsure whether these credentials being accessible is normal or specific to my function. I have not attempted to use the keys because I don't want to access anything without authorization. What exactly are these credentials, and what is the proper way to report the concern if it is a genuine vulnerability?
3 Answers
This is normally expected behavior. A Lambda function runs with an IAM execution role, and AWS obtains temporary credentials for that role through STS. Those credentials are made available to the runtime so the function and its SDKs can access permitted services such as S3 or DynamoDB. They should be short-lived and limited to whatever permissions the execution role has.
If you believe this is more than normal Lambda credential handling, report it through the cloud provider’s official vulnerability-reporting process rather than trying the credentials or posting sensitive details publicly. Include the runtime, what you observed, and non-sensitive evidence. Don’t attempt to access resources or test permissions outside your own authorized environment.
The keys you found are probably temporary credentials for the function’s assumed execution role, not permanent account access keys. Your code can read them because it is running with that role, but that doesn’t give it permissions beyond the role policy. The important security step is to keep the execution role restricted to the minimum permissions the function needs.
I would avoid publishing commands, logs, or screenshots that reveal the credentials or provide a way to reproduce the issue publicly. If the behavior still seems abnormal, document it privately for the provider’s security team.