mcp-server-semgrep/semgrep-rules/terraform/aws/correctness/reserved-aws-lambda-environment-variable.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: reserved-aws-lambda-environment-variable
  message: '`terraform apply` will fail because the environment variable "$VARIABLE"
    is a reserved by AWS. Use another name for "$VARIABLE".'
  languages:
  - hcl
  severity: WARNING
  metadata:
    category: correctness
    references:
    - https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-runtime
    technology:
    - aws
    - aws-lambda
    - terraform
  patterns:
  - pattern-inside: |
      resource "aws_lambda_function" $FUNCTION { ... }
  - pattern-inside: |
      environment { ... }
  - pattern-inside: |
      variables = { ... }
  - pattern: |
      $VARIABLE = ...
  - metavariable-pattern:
      metavariable: $VARIABLE
      patterns:
      - pattern-either:
        - pattern: _HANDLER
        - pattern: _X_AMZN_TRACE_ID
        - pattern: AWS_DEFAULT_REGION
        - pattern: AWS_REGION
        - pattern: AWS_EXECUTION_ENV
        - pattern: AWS_LAMBDA_FUNCTION_NAME
        - pattern: AWS_LAMBDA_FUNCTION_MEMORY_SIZE
        - pattern: AWS_LAMBDA_FUNCTION_VERSION
        - pattern: AWS_LAMBDA_INITIALIZATION_TYPE
        - pattern: AWS_LAMBDA_LOG_GROUP_NAME
        - pattern: AWS_LAMBDA_LOG_STREAM_NAME
        - pattern: AWS_ACCESS_KEY
        - pattern: AWS_ACCESS_KEY_ID
        - pattern: AWS_SECRET_ACCESS_KEY
        - pattern: AWS_LAMBDA_RUNTIME_API
        - pattern: LAMBDA_TASK_ROOT
        - pattern: LAMBDA_RUNTIME_DIR