Environment variables in Lambda in AWS - Step-by-Step Execution

Process Flow - Environment variables in Lambda

Start Lambda Function

↓

Read Environment Variables

↓

Use Variables in Code

↓

Execute Function Logic

↓

Return Result

↓

End Lambda Function

When a Lambda function runs, it first reads environment variables set in its configuration, then uses them in its code before completing execution.

Execution Sample

AWS

import os

def lambda_handler(event, context):
    db_host = os.environ['DB_HOST']
    return f"Connecting to {db_host}"

This Lambda function reads the DB_HOST environment variable and returns a message using it.

Process Table

Step	Action	Environment Variable Accessed	Value Retrieved	Result
1	Start Lambda function	N/A	N/A	Function begins execution
2	Read environment variable DB_HOST	DB_HOST	database.example.com	Variable value stored in db_host
3	Use db_host in return statement	N/A	N/A	Return message created
4	Return result	N/A	N/A	"Connecting to database.example.com" returned
5	End Lambda function	N/A	N/A	Execution complete

💡 Function ends after returning the message using environment variable

Status Tracker

Variable	Start	After Step 2	After Step 3	Final
db_host	undefined	database.example.com	database.example.com	database.example.com

Key Moments - 2 Insights

Why do we access environment variables inside the function and not outside?

Environment variables are read during function execution (see Step 2 in execution_table). They are not available before the function starts.

What happens if the environment variable DB_HOST is not set?

Accessing a missing environment variable causes an error at Step 2, stopping execution. Always ensure variables are set in Lambda configuration.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of db_host after Step 2?

A "database.example.com"

B "localhost"

C undefined

D null

💡 Hint

Check the 'Value Retrieved' column in Step 2 of execution_table

At which step does the Lambda function return its result?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look at the 'Result' column for the step where the return message is created

If the environment variable DB_HOST was missing, what would happen at Step 2?

A The function would continue with db_host as empty string

B An error would occur and execution would stop

C The function would use a default value automatically

D The function would skip reading environment variables

💡 Hint

Refer to key_moments about missing environment variables causing errors

Concept Snapshot

Environment variables in Lambda:
- Set variables in Lambda configuration
- Access inside function code via os.environ
- Use variables to configure behavior without code changes
- Missing variables cause runtime errors
- Helps keep secrets and configs outside code

Full Transcript

When a Lambda function runs, it first reads environment variables set in its configuration. In the example, the function reads the variable DB_HOST at Step 2 and stores it in db_host. Then it uses this value to create a return message at Step 3. The function returns this message at Step 4 and ends execution at Step 5. If the environment variable is missing, an error occurs at Step 2 and the function stops. Environment variables let you change settings without changing code, keeping secrets safe and code flexible.

Practice

1. What is the main purpose of environment variables in an AWS Lambda function?

easy

A. To store configuration settings outside the code for flexibility

B. To write logs directly to CloudWatch

C. To increase the memory allocated to the Lambda function

D. To define the runtime language of the Lambda function

Solution

1. Step 1: Understand environment variables role

   Environment variables hold configuration data separate from code, making functions flexible.

2. Step 2: Compare with other options

   Logging, memory, and runtime are unrelated to environment variables.

3. Final Answer:

   To store configuration settings outside the code for flexibility -> Option A

4. Quick Check:

   Environment variables = configuration outside code [OK]

Hint: Environment variables hold config, not code or logs [OK]

Common Mistakes:

• Confusing environment variables with logging settings
• Thinking environment variables control memory or runtime
• Assuming environment variables store code

2. Which of the following is the correct way to define an environment variable named API_KEY with value 12345 in AWS Lambda console?

easy

A. Create a CloudWatch alarm named API_KEY with threshold 12345

B. Add a tag with key API_KEY and value 12345

C. Write export API_KEY=12345 in the Lambda function code

D. Set key as API_KEY and value as 12345 in the Environment Variables section

Solution

1. Step 1: Identify environment variable setup

   Environment variables are set as key-value pairs in the Lambda console's Environment Variables section.

2. Step 2: Eliminate incorrect options

   Tags, code exports, and CloudWatch alarms do not define environment variables.

3. Final Answer:

   Set key as API_KEY and value as 12345 in the Environment Variables section -> Option D

4. Quick Check:

   Environment variables = key-value pairs in Lambda console [OK]

Hint: Set env vars in Lambda console's Environment Variables section [OK]

Common Mistakes:

• Confusing tags with environment variables
• Trying to set env vars inside code with export
• Using unrelated AWS features like CloudWatch alarms

3. Given this Python Lambda function code:

import os
def lambda_handler(event, context):
    return os.environ.get('MODE', 'default')

If the environment variable MODE is set to production, what will the function return?

medium

A. "default"

B. None

C. "production"

D. An error occurs

Solution

1. Step 1: Understand os.environ.get usage

   os.environ.get('MODE', 'default') returns the value of MODE if set, else 'default'.

2. Step 2: Apply given environment variable

   Since MODE is set to 'production', the function returns 'production'.

3. Final Answer:

   "production" -> Option C

4. Quick Check:

   Env var MODE='production' returns 'production' [OK]

Hint: os.environ.get returns env var value or default if missing [OK]

Common Mistakes:

• Assuming default is always returned
• Expecting None if variable exists
• Thinking code throws error if env var exists

4. A developer sets an environment variable DB_PASSWORD in Lambda console but the function code returns None when accessing it. What is the most likely cause?

medium

A. Lambda function memory is too low

B. The environment variable key is misspelled in the code

C. The environment variable value is encrypted and inaccessible

D. The Lambda function timeout is too short

Solution

1. Step 1: Check environment variable access

   If code returns None, likely the key used in code does not match the set key.

2. Step 2: Exclude unrelated causes

   Memory size, encryption, or timeout do not cause None return for env var access.

3. Final Answer:

   The environment variable key is misspelled in the code -> Option B

4. Quick Check:

   Misspelled env var key returns None [OK]

Hint: Check spelling of env var keys in code vs console [OK]

Common Mistakes:

• Blaming memory or timeout for env var issues
• Assuming encryption blocks access without decryption
• Not verifying exact key names

5. You want to securely store a database password in a Lambda environment variable but avoid exposing it in plain text. Which approach is best practice?

hard

A. Use AWS Lambda environment variables with encryption enabled and grant decryption permissions

B. Hardcode the password directly in the Lambda function code

C. Store the password in a public S3 bucket and read it at runtime

D. Send the password as a query parameter in API requests

Solution

1. Step 1: Understand secure storage options

   Lambda environment variables support encryption with AWS KMS and access control.

2. Step 2: Evaluate other options

   Hardcoding, public S3, or sending passwords in query parameters expose secrets and are insecure.

3. Final Answer:

   Use AWS Lambda environment variables with encryption enabled and grant decryption permissions -> Option A

4. Quick Check:

   Encrypted env vars + permissions = secure secret storage [OK]

Hint: Encrypt env vars and control access for secrets [OK]

Common Mistakes:

• Hardcoding secrets in code
• Using public storage for passwords
• Exposing secrets in API requests