SONARPY-3062 Create rule S7617 Reserved environment variable names should not be overridden in Lambda functions

rules/S7617/metadata.json

@@ -0,0 +1,2 @@
+{
+}

rules/S7617/python/metadata.json

@@ -0,0 +1,24 @@
+{
+  "title": "Reserved environment variable names should not be overridden in Lambda functions",
+  "type": "CODE_SMELL",
+  "status": "ready",
+  "remediation": {
+    "func": "Constant\/Issue",
+    "constantCost": "5min"
+  },
+  "tags": [
+  ],
+  "defaultSeverity": "Major",
+  "ruleSpecification": "RSPEC-7617",
+  "sqKey": "S7617",
+  "scope": "All",
+  "defaultQualityProfiles": ["Sonar way"],
+  "quickfix": "unknown",
+  "code": {
+    "impacts": {
+      "MAINTAINABILITY": "HIGH",
+      "RELIABILITY": "MEDIUM"
+    },
+    "attribute": "CONVENTIONAL"
+  }
+}

rules/S7617/python/rule.adoc

@@ -0,0 +1,61 @@
+Reserved environment variable names should not be overridden in Lambda functions
+
+== Why is this an issue?
+
+AWS Lambda reserves certain environment variable names for its internal operations and runtime management. These reserved variables, such as '_HANDLER', '_X_AMZN_TRACE_ID', 'AWS_REGION', and others, are automatically set by the Lambda service and contain critical information about the function's execution context. When application code overrides these reserved environment variables by assigning new values to them, it can disrupt the Lambda runtime's ability to function correctly. The Lambda service relies on these variables to manage function execution, implement tracing, handle authentication, and maintain proper communication with other AWS services.
+
+=== What is the potential impact?
+
+Overriding reserved environment variables can lead to unpredictable Lambda function behavior, runtime failures, broken tracing and monitoring capabilities, authentication issues with AWS services, and difficulty in debugging production problems. This can result in service outages and degraded system reliability.
+
+== How to fix it
+
+Avoid modifying any environment variable names that are reserved by AWS Lambda. Use custom environment variable names that do not conflict with AWS Lambda's reserved names. Always prefix your custom environment variables with a unique identifier or use descriptive names that clearly indicate they are application-specific.
+
+==== Noncompliant code example
+
+[source,python,diff-id=1,diff-type=noncompliant]
+----
+import os
+
+def lambda_handler(event, context):
+  os.environ['AWS_REGION'] = "us-west-2"  # Noncompliant: overriding AWS Lambda reserved environment variable  
+  return {"statusCode": 200}
+----
+
+==== Compliant solution
+
+[source,python,diff-id=1,diff-type=compliant]
+----
+import os
+
+def lambda_handler(event, context):
+  os.environ['APP_REGION'] = "us-west-2" # Compliant: using custom environment variable names  
+  return {"statusCode": 200}
+----
+
+== Resources
+
+=== Documentation
+
+- AWS documentation - https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html[AWS Lambda environment variables documentation]
+- AWS documentation - https://docs.aws.amazon.com/lambda/latest/dg/python-handler.html[AWS Lambda Python handler documentation]
+
+=== Standards
+
+CWE-20: Improper Input Validation
+
+ifdef::env-github,rspecator-view[]
+
+== Implementation Specification
+(visible only on this page)
+
+=== Message
+
+Do not override reserved environment variable names in Lambda functions.
+
+=== Highlighting
+
+Primary location: the assignment to the reserved environment variable
+
+endif::env-github,rspecator-view[]