Explain the use of environment variables in AWS Lambda.

Official answer

Lambda environment variables are string key/value configuration associated with a function. They let the same code use different resource names, feature settings or non-secret endpoints across environments. Read them through the runtime's environment API and validate required values and types.

Values are literal strings: Lambda does not perform shell-style expansion of one variable inside another. For example, a value containing $OTHER is not automatically replaced by the other variable's value. Parse numeric or boolean settings explicitly and reject invalid values instead of silently using unsafe defaults.

Environment variables are versioned with published function configuration. Updating $LATEST does not change an already published version. They are not a shared database or a mechanism for propagating mutable per-request state among concurrent execution environments.

Lambda encrypts stored environment variables, but AWS recommends Secrets Manager for passwords, API keys and similar sensitive values. Store a secret identifier in configuration and retrieve it under least-privilege access, with a tested cache/rotation strategy. Encryption at rest does not prevent privileged code or configuration access, and logs must not expose values.

Review configuration changes with code/infrastructure changes, verify environment isolation and test missing or malformed settings. Also respect the documented key rules and aggregate configuration-size limit.

Environment-variable behavior and security, published versions