AWS Lambda function update command showing environment variables - gitlab

Question

I'm using gitlab pipelines to update configuration and code of my AWS Lambda functions. I noticed that when you perform AWS cli requests to update the Lambda like:
aws lambda update-function-configuration --region $your_region --function-name $your_lambda_arn --handler $your_lambda_handler --runtime $your_lambda_runtime
OR
aws lambda update-function-code --region $your_region --function-name $your_lambda_arn --s3-bucket $your_s3_bucket --s3-key $your_project_name.zip
Both requests responses in gitlab console reveals the environment variables (like db connection string) and I would like to keep it secret. Is there any way, any flag or whatsoever to keep these values hidden in response?
Regards

Answer 1

Could perhaps use jq to exclude the output? Otherwise use an SDK (e.g. boto3 or aws-sdk-go) and don't print the entire response.
$ cat ~/Desktop/Me.json
{
"FunctionName": "my-function",
"LastModified": "2019-09-26T20:28:40.438+0000",
"RevisionId": "e52502d4-9320-4688-9cd6-152a6ab7490d",
"MemorySize": 256,
"Version": "$LATEST",
"Role": "arn:aws:iam::123456789012:role/service-role/my-function-role-uy3l9qyq",
"Timeout": 3,
"Runtime": "nodejs10.x",
"TracingConfig": {
"Mode": "PassThrough"
},
"Environment": {
"foo": "bar"
},
"CodeSha256": "5tT2qgzYUHaqwR716pZ2dpkn/0J1FrzJmlKidWoaCgk=",
"Description": "",
"VpcConfig": {
"SubnetIds": [],
"VpcId": "",
"SecurityGroupIds": []
},
"CodeSize": 304,
"FunctionArn": "arn:aws:lambda:us-west-2:123456789012:function:my-function",
"Handler": "index.handler"
}
# no Environment key
$ cat ~/Desktop/Me.json | jq 'del(.Environment)'
{
"FunctionName": "my-function",
"LastModified": "2019-09-26T20:28:40.438+0000",
"RevisionId": "e52502d4-9320-4688-9cd6-152a6ab7490d",
"MemorySize": 256,
"Version": "$LATEST",
"Role": "arn:aws:iam::123456789012:role/service-role/my-function-role-uy3l9qyq",
"Timeout": 3,
"Runtime": "nodejs10.x",
"TracingConfig": {
"Mode": "PassThrough"
},
"CodeSha256": "5tT2qgzYUHaqwR716pZ2dpkn/0J1FrzJmlKidWoaCgk=",
"Description": "",
"VpcConfig": {
"SubnetIds": [],
"VpcId": "",
"SecurityGroupIds": []
},
"CodeSize": 304,
"FunctionArn": "arn:aws:lambda:us-west-2:123456789012:function:my-function",
"Handler": "index.handler"
}

Answer 2

I've found two additional solutions for that case:
Gitlab itself has mechanism of hiding secrets, to achieve that you can setup environment variable in gitlab cicd settings as protected, in that case console output should be hidden where needed
You can filter out the aws cli response
https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-filter.html
Regards