Existing check search

• I have searched existing issues, Prowler Hub, and the public roadmap, and this check does not already exist.

Provider

AWS

New provider name

No response

Service or product area

awslambda

Suggested check name

awslambda_layer_no_secrets_in_content

Context and goal

AWS Lambda layers package shared code and dependencies pulled into functions. Secrets baked into a layer are as sensitive as those in function code, but are not covered by the existing function-code check.

Expected behavior

• Resource or scope to evaluate: Each Lambda layer version's content.
• PASS when: No secrets are detected in the layer content.
• FAIL when: A secret is detected (report layer name/version and file, not the value).

References

• Umbrella issue: Implement more secrets checks #3085
• Secret scanning checks (developer guide): https://docs.prowler.com/developer-guide/secret-scanning-checks
• API/SDK reference: lambda list_layers / list_layer_versions / get_layer_version (Content.Location -> download & unzip)
• Reference code: awslambda_function_no_secrets_in_code

Suggested severity

High

Additional implementation notes

Mirror awslambda_function_no_secrets_in_code: download the layer content zip to a temp file, scan with detect-secrets, and clean up. Reuse the existing awslambda service. Severity is High by default and becomes Critical if the secret is validated.