Check who publishes the extension, what it can read, how it is updated, and what it adds to start up time. An extension runs in the same execution environment as your function and shares its permissions, credentials and environment variables, so it deserves the same review as a library.
What an extension actually is
AWS describes two kinds. An external extension runs as an independent process in the execution environment and keeps running after the invocation finishes. An internal extension runs as part of the runtime process, reached through wrapper scripts or settings such as JAVA_TOOL_OPTIONS. Extensions are usually added as layers. During the init phase Lambda extracts them to /opt and launches executables found in /opt/extensions.
Two sentences from the AWS pages matter most for review. Permissions, resources, credentials and environment variables are shared between the function and the extensions. And extensions have access to the same resources as the function.
Five questions to ask
| Question | Why it matters |
|---|---|
| Who publishes it, and can you verify that? | An extension is code you run next to your secrets |
| What does it read? | It can see environment variables, including any credentials you place there |
| Where does it send data? | Monitoring tools send telemetry out; confirm destinations and what is included |
| How does it update? | Layer versions are immutable, so a fix means a new ARN |
| What does it cost at start up? | Each extension must finish init before your function is invoked |
Performance is a security signal too
AWS notes that extensions share CPU, memory and storage with your function, and a slow init increases latency. An extension that crashes during init shows up in the init report log as an extension error. Shutdown is also affected: with external extensions Lambda allows up to 2,000 ms for the shutdown phase, and processes that do not respond are ended with a kill signal.
Practical controls
- Keep secrets out of environment variables where you can. Everything in the environment is visible to extensions. Fetch secrets at runtime from a secrets service, with a narrow role.
- Use a narrow execution role. Whatever the function can do, the extension can do.
- Pin extension layer versions in infrastructure code and review changes in pull requests.
- Compare function versions side by side, as AWS suggests, to measure an extension's overhead before you roll it out.
- Track the extension in your inventory with version, purpose and owner.
- Remove unused extensions. A forgotten extension is standing access.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a gate evaluates a change before merge. A new extension layer ARN in an infrastructure diff is a good change to put behind review.
Quick check
Can an extension see my function's environment variables?
Yes. AWS states that permissions, resources, credentials and environment variables are shared between the function and its extensions.
Do extensions count toward the package size limit?
Yes. AWS says the unzipped size of the function and all extensions cannot exceed the 250 MB limit for a .zip deployment.
Safeguard's policies and gates can check infrastructure and dependency changes before merge, and its asset discovery helps keep the inventory current. Try a free scan at gold.safeguard.sh/scan.
Sources
- Augment Lambda functions using Lambda extensions
- Lambda execution environment lifecycle
- Lambda quotas
Last reviewed: 19 October 2026.
