[Bug] Lambda MicroVM wont start in hardend mode because of AWS_ envs

[snapydziuba]

Starting a Lambda MicroVM in hardend mode results in the following error on start

{
    "level": 50,
    "time": 1789472528666,
    "pid": 1,
    "hostname": "localhost",
    "err": {
        "type": "q1",
        "message": "Forbidden sandbox-runner env in hardened mode: AWS_LAMBDA_MICROVM_IMAGE_ARN, AWS_LAMBDA_MICROVM_IMAGE_NAME, AWS_LAMBDA_MICROVM_IMAGE_VERSION, AWS_REGION",
        "stack": "SandboxSecureStartupError: Forbidden sandbox-runner env in hardened mode: AWS_LAMBDA_MICROVM_IMAGE_ARN, AWS_LAMBDA_MICROVM_IMAGE_NAME, AWS_LAMBDA_MICROVM_IMAGE_VERSION, AWS_REGION\n    at AW (/sandbox_api/.build/index.js:311:13888)\n    at pk (/sandbox_api/.build/index.js:320:32100)\n    at /sandbox_api/.build/index.js:320:33064",
        "name": "SandboxSecureStartupError"
    },
    "msg": "Sandbox API startup failed"
}

This happens with a fresh clone on 840537b

I have added to the
api/src/secure-startup.ts the following fix

const ALLOWED_LAMBDA_MICROVM_AWS_ENV = new Set([
  'AWS_LAMBDA_MICROVM_IMAGE_ARN',
  'AWS_LAMBDA_MICROVM_IMAGE_NAME',
  'AWS_LAMBDA_MICROVM_IMAGE_VERSION',
  'AWS_REGION',
]);

and updated the following line

code-interpreter/api/src/secure-startup.ts

Line 60 in 840537b

if (name.startsWith('AWS_')) forbidden.push(name);

to

if (name.startsWith('AWS_') && !ALLOWED_LAMBDA_MICROVM_AWS_ENV.has(name)) forbidden.push(name);

This was the easiest fix, i have not investigated if i could remove the ENVs completely before the start was i was fine with them being exposed.