Severity: High
Description: This control ensures that environment variables are encrypted with a Customer Master Key at rest. Lambda environment variables can contain sensitive information such as database connection info and should be protected when stored.
Remediation Steps:
Perform following to remove cross account triggers from lambda function:
Login to the AWS Management Console at https://console.aws.amazon.com.
Navigate to AWS Lambda console.
In the navigation pane, select Functions.
Select the function to be modified.
Navigate to Environment Variables.
Under AWS KMS key to encrypt at rest, choose Use a customer master key.
Select the KMS key of choice.
Click Save changes to apply.
Important:
Additional charges may apply when using AWS KMS CMK.
Reference: