Environment Variables

Scenarios

Environment variables allow you to pass dynamic parameters to a function without modifying code.

Scenarios:

• Environment distinguishing: Configure different environment variables for the same function logic. For example, use environment variables to configure testing and development databases.
• Configuration encryption: Configure encrypted environment variables to dynamically obtain authentication information (account, password) required to access other services.
• Dynamic configuration: Configure environment variables for parameters that need to be dynamically adjusted, including query period and timeout, in function logic.

Notes and Constraints

When you define environment variables, FunctionGraph displays all your input information in plain text. For security purposes, do not include sensitive information.

Configuring Environment Variables

1. Log in to the FunctionGraph console. In the navigation pane, choose Functions > Function List.
2. Click the name of a function.
3. Choose Configuration > Environment Variables and click Edit Environment Variable.
   Figure 1 Adding environment variables
   
4. On the displayed dialog box, click Add and configure the environment variable information.

   Editing environment variables using a form

   • For details about the parameters for editing environment variables using a form, see Table 1.

     Table 1 Parameters for configuring environment variables

     Parameter	Description
     Key	Key of the environment variable. The key must start with a letter and can contain a maximum of 4,096 characters, including letters, digits, underscores (_), hyphens (-), and periods (.). Some environment variables are preset in the system. You cannot configure environment variables with the same name as the preset environment variables. For details about the preset environment variables, see Preset Environment Variables.
     Value	Value of the environment variable. The total length of the key and value cannot exceed 4,096 characters.
     Encrypted	If enabled, the environment variable value is encrypted and displayed as an asterisk (*). During parameter transmission, the key value is also encrypted. Encrypted and saved environment variable values will be reset to empty if the encryption is disabled. Figure 2 Editing environment variables using a form
     Encryption for Transfer	This parameter is available only in the LA-Sao Paulo1 region. CAUTION: DEW is billed by the pay-per-use mode. For details, see DEW Billing. Click Enable to encrypt the environment variable. The following encryption types are supported: AES: Encrypt environment variables using AES. You do not need to manually create a key. KMS: You can select an existing KMS key to encrypt the function environment variable. Prerequisites Before using KMS to encrypt environment variables, make sure you have granted the function the permission to decrypt environment variables. For details, see Creating a Custom Policy in JSON View. Go to the IAM console and add the permission policy to the function agency. For details, see Configuring an Agency. Selecting a KMS key Select the enabled customer master key (CMK). If no key is available, create one by referring to Creating a Custom Key. CAUTION: Do not delete the CMK used for function encryption in DEW. Otherwise, the function execution will fail because encrypted data cannot be decrypted. Decrypting environment variables After KMS is used to encrypt environment variables, add Decryption Code Snippet to the function code to decrypt the environment variables. Replace {endpoint} in the code with the endpoint of the corresponding region. Figure 3 Encryption during transmission If the parameter is enabled, the environment variable value is encrypted and displayed as an asterisk (*). During parameter transmission, the key value is also encrypted. Encrypted and saved environment variable values will be reset to empty if the encryption is disabled.

   Editing environment variables in JSON

   • The following is an example of editing environment variables in JSON format.

     {
         "obs_output_bucket": "obs_image"
     }

     To use AES to encrypt environment variables, add the prefix _encrypt_ to the key.

     {
         "_encrypt_obs_output_bucket": "obs_image"
     }

5. Configure Static Encryption for the environment variables. (This step is optional and available only in the LA-Sao Paulo1 region.)
   To use static encryption with KMS, add the permission policy to the agency of the function. The following KMS static encryption modes are supported:

   • functiongraph/default (default): The function automatically creates a default key in DEW.
   • Customer master key (CMK): Select the CMK to encrypt the code. For details about how to create a CMK, see Creating a Custom Key.
   

   If you select Customer master key (CMK), do not delete the CMK used for function encryption in DEW. Otherwise, the function execution will fail because encrypted data cannot be decrypted.

6. After the configuration is complete, click OK to save the environment variables.

   After the environment variables are configured, you can use the environment variables in functions. For details, see Application Example of Environment Variables.

Preset Environment Variables

Table 2 lists the preset environment variables.

Application Example of Environment Variables

You can use environment variables to configure which directory to install files in, where to store outputs, and how to store connection and logging settings. These settings are decoupled from the application logic, so you do not need to update your function code when you change the settings.

1. Using environment variable obs_output_bucket, you can flexibly set the OBS bucket used for storing output images.
   Figure 4 Environment variables
   
2. Use environment variables in function code.

   In the following code snippet, obs_output_bucket is the bucket used for storing processed images.

   

   • Non-HTTP functions use context.getUserData ('xxx') to obtain environment variables.
   • HTTP functions use system methods to obtain environment variables. For example, Python functions use os.Environ['xx'], and Node.js functions use process.env.xx. Node.js functions use process.env.RUNTIME_USERDATA to obtain encrypted environment variables.
   • Python

     def handler(event, context):
         srcBucket, srcObjName = getObsObjInfo4OBSTrigger(event)
         obs_address = context.getUserData('obs_address')
         outputBucket = context.getUserData('obs_output_bucket')
         if obs_address is None:
             obs_address = '{obs_address_ip}'
         if outputBucket is None:
             outputBucket = 'casebucket-out'
                 
         ak = context.getSecurityAccessKey()
         sk = context.getSecuritySecretKey()
         st = context.getSecurityToken()
     
         # download file uploaded by user from obs 
         # TODO: Replace with actual implementation
         GetObject(obs_address, srcBucket, srcObjName, ak, sk, st)
     
         outFile = watermark_image(srcObjName)
         
         # Upload converted files to a new OBS bucket.
         # TODO: Replace with actual implementation
         PostObject(obs_address, outputBucket, outFile, ak, sk, st)
     
         return 'OK'

   • Node.js

     exports.handler = async (event, context) => {
         let bucket = context.getUserData('obs_output_bucket');
         console.log(bucket);
         const output =
         {
             'statusCode': 200,
             'headers':
             {
                 'Content-Type': 'application/json'
             },
             'isBase64Encoded': false,
             'body': JSON.stringify(event),
         }
         return output;
     }

Helpful Links

• Manage the function lifecycle using APIs. For details, see Function Lifecycle Management APIs.
• For FAQs about function environment variables, see Function Configuration FAQs.