How does aws-sdk in Lambda get the credentials automagically?

Question

If you use aws-sdk in a Lambda runtime, you don't need provide the credentials to the SDK because it gets the credentials automatically from the execution role of that Lambda function.

I'm curious about that how does this work under the hood? Does the SDK read the credentials from some env variables? How does it get the credentials from the Lambda runtime actually?

Answer 1

Does the SDK read the credentials from some env variables?

Yes. They are taken from Runtime environment variables which include:

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• AWS_SESSION_TOKEN

which come from:

The access keys obtained from the function's execution role.