Menu
Ensure encryption in transit is enabled for Lambda environment variables
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-compute-12-12The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-aws-compute-12.12 |
| description | Ensure encryption in transit is enabled for Lambda environment variables |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","lambda","serverless","encryption","transit","environment-variables","kms"] |
| cis_id | 12.12 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-12.3","cis-aws-compute-12.11"] |
| prerequisites | [] |
| severity_boost | {} |
As you can set your own environmental variables for Lambda it is important to also encrypt them for in transit protection.
Lambda environment variables should be encrypted in transit for client-side protection as they can store sensitive information.
Enabling encryption in transit adds encryption overhead and may require updates to Lambda function code to decrypt environment variables at runtime.
AWS Lambda, click Functions.Function name click on the name of the function that you want to reviewEnvironment variables.Environment variables section, click Editaws lambda list-functionsaws lambda list-functions --output table --query "Functions[*].FunctionName"
This command will provide a table titled ListFunctions
aws lambda get-functionaws lambda get-function --function-name "name_of_function" --query "Configuration.Environment"
This will provide an output of the environment variables created for that function.
All Lambda function environment variable values are encrypted in transit (values appear as encrypted ciphertext rather than plain text).
AWS Lambda, click Functions.Function name click on the name of the function that you want to reviewEnvironment variables.Environment variables section, click EditEnable helpers for encryption in transitEncrypt option for all the variable that need to be encrypted.N/A - This control is Console-based remediation only.
Lambda environment variables are encrypted at rest by default using AWS managed keys, but encryption in transit (client-side encryption) is not enabled by default.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.10 Encrypt Sensitive Data in Transit - Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure Shell (OpenSSH). | x | x | |
| v8 | 3.11 Encrypt Sensitive Data at Rest - Encrypt sensitive data at rest on servers, applications, and databases containing sensitive data. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data. | x | x | |
| v7 | 10.4 Ensure Protection of Backups - Ensure that backups are properly protected via physical security or encryption when they are stored, as well as when they are moved across the network. This includes remote backups and cloud services. | x | x | x |
Level 1 | Manual