Skip to content
This repository has been archived by the owner on Jan 8, 2024. It is now read-only.

aws/lambda: Inject deployment configs to Lambda functions #4328

Merged
merged 2 commits into from Dec 14, 2022
Merged

Conversation

catsby
Copy link
Member

@catsby catsby commented Dec 13, 2022

This PR injects the Waypoint deployment env vars into the Lambda function environment, so that the bundled entrypoint has the information it needs to connect to the Waypoint server. This should enable things like config vars to work in lambda functions.

This does expose the values in the functions configuration for all to see, but I don't know if that is a concern or not:

lambda_configs

@catsby catsby added pr/no-changelog No automatic changelog entry required for this pull request plugin/lambda labels Dec 13, 2022
@catsby catsby requested review from a team December 13, 2022 23:44
@catsby catsby removed the pr/no-changelog No automatic changelog entry required for this pull request label Dec 13, 2022
@paladin-devops
Copy link
Contributor

This does expose the values in the functions configuration for all to see, but I don't know if that is a concern or not

If I'm not mistaken, ECS tasks expose the token in a similar way. This AWS blog post recommends using Vault or AWS Secrets Manager. I think integrating with some kind of secrets management solution here, though, doesn't need to be in this PR, and could be a follow-up enhancement.

Also, since it's an invite token (WAYPOINT_CEB_INVITE_TOKEN), I think that means it can be used only once, so after the function redeems the invite token, it shouldn't be able to be used again by an attacker.

@catsby catsby merged commit 341fb39 into main Dec 14, 2022
@catsby catsby deleted the lambda-vars branch December 14, 2022 14:18
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants