I’m developing a Lambda function on AWS that runs untrusted code, like a sandbox, however, I have some keys and sensitive information (also, I want to avoid code leak too) which I want to be sure that users can’t access, I’ve been trying to find a way to cut the untrusted Python code access to the filesystem (or isolate it somehow). Is there any configuration or recommended practice to restrict filesystem access within an AWS Lambda in this case?

Also I’ve attempted to use containers and chroot to restrict the code, however, the AWS Lambda environment limits access to these tools, I’ve read about seccomp and SELinux, but I believe there will be no sucess due to these restrictions too. Is there any way I can prevent this script from acessing other files? If don’t, do you have any recommendations to solve this problem (I’m thinking about Fargate for structure and EFS to dynamic code, but I’m not really sure if price would increase at a point that makes the solution impracticable)