AWS Lambda - Encrypted Environment Variable

Environment Variable Creation

After pasting your token you need to encrypt it. This is done by checking the Enable Helpers checkbox.

Prior to hitting the Encrypt option you need to decide which Key to use. Let us use the KMS key that we created above. 

 

When you hit the Encrypt option, you will need to select the key and then hit the Encrypt button.

You will now see the encrypted token in the environment variable. Hit Save to complete the step.

Adding Code to Read Encrypted Environment Variable

The decryption is done via aws-sdk. Here are some lines that need to be added to the code that we had previously used.

These lines need to be added at the top of index.js

var aws = require('aws-sdk');

// Set the region 
aws.config.update({ region: '<your-aws-region>' });

// token is not assigned

let rundeck_auth_token;

// this the encrypted variable from the environment

const encrypted = process.env['rundeck_auth_token'];

These lines need to be added at the top of export.handler function, just after the declaration of the variables.

 

if (!rundeck_auth_token) {

	// Decrypt code should run once and variables stored outside of the
	// function handler so that these are decrypted once per container
	const kms = new aws.KMS();
	try {
		const req = { CiphertextBlob: Buffer.from(encrypted, 'base64') };
		const data = await kms.decrypt(req).promise();
		rundeck_auth_token = data.Plaintext.toString('ascii');
	}
	catch (err) {
		console.log('Decrypt error:', err);
		throw err;
	}
}