AWS lambda high security documentation change
Summary
Updated certificate handling documentation for Node.js runtimes, specifying Node.js 20+ requires explicit CA certificate configuration via NODE_EXTRA_CA_CERTS environment variable
Security assessment
The change addresses secure TLS connections by documenting required configuration changes for newer Node.js versions. Failure to set NODE_EXTRA_CA_CERTS in Node.js 20+ could lead to SSL verification failures and insecure connections. This directly impacts security by preventing potential man-in-the-middle attacks and maintaining certificate trust.
Diff
diff --git a/lambda/latest/dg/services-rds.md b/lambda/latest/dg/services-rds.md index b3fc32caa..d31542c69 100644 --- a//lambda/latest/dg/services-rds.md +++ b//lambda/latest/dg/services-rds.md @@ -137 +137,7 @@ To make secure SSL/TLS connections to an Amazon RDS database instance, your Lamb - * [.zip file archives](./configuration-function-zip.html): Lambda's managed runtimes include both Certificate Authority (CA) certificates and the certificates required for connections to Amazon RDS database instances. It might take up to 4 weeks for Amazon RDS certificates for new AWS Regions to be added to the Lambda managed runtimes. + * [.zip file archives](./configuration-function-zip.html): Certificate handling varies by runtime: + + * **Node.js 18 and earlier** : Lambda automatically includes CA certificates and RDS certificates. + + * **Node.js 20 and later** : Lambda no longer loads additional CA certificates by default. Set the `NODE_EXTRA_CA_CERTS` environment variable to `/var/runtime/ca-cert.pem`. + +It might take up to 4 weeks for Amazon RDS certificates for new AWS Regions to be added to the Lambda managed runtimes.