core: template validation rule E3663 wrongly reports TZ as a reserved Lambda environment variable

[Ayaka-Soeda]

Describe the bug

The bundled CloudFormation template validation reports E3663 ("Environment variable 'TZ' is a Lambda reserved key") for every Lambda function that sets the TZ environment variable.

TZ is not a reserved Lambda environment variable. The AWS Lambda documentation lists it under Unreserved environment variables:

The following additional environment variables aren't reserved and can be extended in your function configuration.

• TZ – The environment's time zone (:UTC). The execution environment uses NTP to synchronize the system clock.

https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html

Setting TZ is accepted by the Lambda API and honored by the runtime, so this is a false positive.

Two other places in the AWS toolchain already agree that TZ is not reserved:

• aws-cdk-lib's own Function.addEnvironment() guard lists 18 reserved keys and does not include TZ (aws-cdk-lib/aws-lambda/lib/function.js)
• cfn-lint, which owns rule E3663, does not include TZ in its list (src/cfnlint/data/schemas/extensions/aws_lambda_function/environment_variable_keys.json)

The list bundled in @aws/cloudformation-validate does include it:

_lambda_reserved_env_keys := {
    "_HANDLER", "_X_AMZN_TRACE_ID", "AWS_DEFAULT_REGION", "AWS_REGION",
    "AWS_EXECUTION_ENV", "AWS_LAMBDA_FUNCTION_NAME", "AWS_LAMBDA_FUNCTION_MEMORY_SIZE",
    "AWS_LAMBDA_FUNCTION_VERSION", "AWS_LAMBDA_LOG_GROUP_NAME",
    "AWS_LAMBDA_LOG_STREAM_NAME", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY",
    "AWS_SESSION_TOKEN", "AWS_LAMBDA_RUNTIME_API", "LAMBDA_TASK_ROOT",
    "LAMBDA_RUNTIME_DIR", "TZ",
}

(found in node_modules/aws-cdk-lib/node_modules/@aws/cloudformation-validate/bindings_wasm_bg.wasm)

In our application this rule accounts for 15 of the warnings emitted on every synth, which drowns out the findings that matter.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

Not emitted by versions predating the always-on template validation

Expected Behavior

cdk synth emits no E3663 finding for a Lambda function that sets the TZ environment variable.

Current Behavior

Every Lambda function that sets TZ produces a warning:

WARNING Environment.Variables: Environment variable 'TZ' is a Lambda reserved key (CloudFormation Validate)
MyStack/MyFunction/Resource (MyFunctionABC12345) aws-cdk-lib.aws_lambda.CfnFunction
Acknowledge with 'CloudFormation-Validate::E3663'

Reproduction Steps

new lambda.Function(this, 'Fn', {
  runtime: lambda.Runtime.NODEJS_22_X,
  handler: 'index.handler',
  code: lambda.Code.fromInline('exports.handler = async () => {};'),
  environment: { TZ: 'Asia/Tokyo' },
});

Run cdk synth.

Possible Solution

Remove "TZ" from _lambda_reserved_env_keys in @aws/cloudformation-validate, aligning it with cfn-lint and with Function.addEnvironment().

Additional Information/Context

Validations.of(scope).acknowledge({
  id: 'CloudFormation-Validate::E3663',
  reason: 'TZ is not a reserved Lambda environment variable',
});

AWS CDK Library version (aws-cdk-lib)

2.1134.0 (build d87457e)

AWS CDK CLI version

aws-cdk-lib 2.263.0 (bundles @aws/cloudformation-validate 1.6.0-beta)

Node.js Version

v24.15.0

OS

macOS 26.6.2

Language

TypeScript

Language Version

TypeScript 6.0.3

Other information

No response