fix(lambda): add a synth-time check for environment variables

packages/@aws-cdk/aws-lambda/lib/function.ts

@@ -347,6 +347,12 @@ export class Function extends FunctionBase {
       this.role.addToPolicy(statement);
     }
 
+    const stack = cdk.Stack.find(this);
+    const isChina = stack.env.region && stack.env.region.startsWith('cn-');
+    if (isChina && props.environment && Object.keys(props.environment).length > 0) {
+      throw new Error(`Environment variables are not supported in this region (${stack.env.region}); consider using tags or SSM parameters instead`);
+    }
+
     const resource = new CfnFunction(this, 'Resource', {
       functionName: props.functionName,
       description: props.description,

packages/@aws-cdk/aws-lambda/test/test.lambda.ts

@@ -1178,6 +1178,52 @@ export = {
     test.done();
   },
 
+  'environment variables are prohibited in China'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack(undefined, undefined, { env: { region: 'cn-north-1' }});
+
+    // WHEN
+    test.throws(() => {
+      new lambda.Function(stack, 'MyLambda', {
+        code: new lambda.InlineCode('foo'),
+        handler: 'index.handler',
+        runtime: lambda.Runtime.NodeJS,
+        environment: {
+          SOME: 'Variable'
+        }
+      });
+    }, /Environment variables are not supported/);
+
+    test.done();
+  },
+
+  'environment variables work in an unspecified region'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    // WHEN
+    new lambda.Function(stack, 'MyLambda', {
+      code: new lambda.InlineCode('foo'),
+      handler: 'index.handler',
+      runtime: lambda.Runtime.NodeJS,
+      environment: {
+        SOME: 'Variable'
+      }
+    });
+
+    // THEN
+    expect(stack).to(haveResource('AWS::Lambda::Function', {
+      Environment: {
+        Variables: {
+          SOME: "Variable"
+        }
+      }
+    }));
+
+    test.done();
+
+  },
+
   'support reserved concurrent executions'(test: Test) {
     const stack = new cdk.Stack();