For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/iac_security/iac_rules/ansible-aws-hardcoded-aws-access-key-in-lambda.md.
A documentation index is available at /llms.txt.
Hardcoding AWS secret access keys in Ansible Lambda tasks exposes credentials to source control, logs, and build artifacts. Attackers who obtain the key can impersonate the account and access AWS resources. This check targets Ansible tasks using the amazon.aws.lambda or lambda modules and flags tasks that include an aws_access_key property containing a 40-character plaintext secret (matched by regex ^[A-Za-z0-9/+=]{40}$).
Do not set aws_access_key or aws_secret_key inline. Instead, supply credentials via IAM instance/profile roles, shared AWS credential profiles, environment variables, or encrypted secrets (Ansible Vault or a secrets manager). You can also reference vaulted or lookup variables in the task. Tasks with a literal 40-character aws_access_key value are flagged. Omitting the properties to rely on role-based auth or referencing vaulted variables is acceptable.
Secure examples:
- name:Deploy Lambda using instance profile (no inline credentials)amazon.aws.lambda:name:my_functionstate:presentregion:us-east-1
- name:Deploy Lambda with credentials stored in Ansible Vaultamazon.aws.lambda:name:my_functionstate:presentregion:us-east-1aws_access_key:"{{ vault_aws_access_key }}"aws_secret_key:"{{ vault_aws_secret_key }}"
