Skip to main content

🛡️ AWS Lambda Function Runtime is deprecated🟢

Stats​

not available

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Lambda functions whose configured runtime is past the AWS Lambda runtime deprecation date. It evaluates the Runtime on the AWS Lambda Function record for Zip deployments.

AWS Lambda supports multiple runtimes for various programming languages. Each runtime is tied to a specific version of the programming language and underlying operating system. When a language or operating system reaches its end of life (EOL), AWS deprecates the associated Lambda runtime.

Rationale​

AWS may stop providing security updates at runtime deprecation, and functions using a deprecated runtime are no longer eligible for technical support. Existing functions can remain invocable indefinitely but may encounter vulnerabilities, expired certificates, or other failures. Owners can address the finding by migrating to a supported runtime or safely retiring an obsolete function.

Deprecation, blocking function creation, and blocking function updates are separate stages. The console prevents creation and updates using a deprecated runtime at deprecation; CLI/API restrictions follow the published create/update-block dates, which AWS can delay. Those delays do not extend runtime support. For example, Python 3.10 is scheduled for deprecation on October 31, 2026; this policy flags it beginning November 1, 2026 UTC, even though its API create/update blocks are scheduled for 2027.

... see more

Remediation​

Open File

Remediation​

Migrate the configured function runtime​

  1. Review the AWS Lambda runtime schedule and choose a generally available, supported target with sufficient remaining support. Use the Lambda-specific date rather than the upstream language or Amazon Linux end-of-life date alone. For provided runtimes, upgrade the OS-only runtime and separately verify the support status of the custom language runtime, bootstrap, and libraries.

  2. Confirm the configured runtime and package type:

    aws lambda get-function-configuration --function-name {{function-name}}

    Review the Runtime and PackageType values. This policy assesses the function configuration and does not require an inventory of retained published versions.

  3. Update and test application code, dependencies, and layers for the selected runtime. Test representative events, permissions, native dependencies, architecture, networking, and error handling in a separate function or deployment environment before production changes.

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Lambda.2] Lambda functions should use supported runtimes1no data
💼 Cloudaware Framework → 💼 Infrastructure Modernization39no data
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)3147no data
💼 FedRAMP High Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)2724no data
💼 FedRAMP High Security Controls → 💼 SI-2(2) Automated Flaw Remediation Status (M)(H)9no data
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)45no data
💼 FedRAMP Low Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)24no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)347no data
💼 FedRAMP Moderate Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)224no data
💼 FedRAMP Moderate Security Controls → 💼 SI-2(2) Automated Flaw Remediation Status (M)(H)9no data
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations47no data
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties63no data
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities63no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks54no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration746no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2 Flaw Remediation6621no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(2) Flaw Remediation _ Automated Flaw Remediation Status19no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(4) Flaw Remediation _ Automated Patch Management Tools9no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(5) Flaw Remediation _ Automatic Software and Firmware Updates29no data
💼 PCI DSS v4.0.1 → 💼 12.3.4 Hardware and software technologies in use are reviewed at least once every 12 months.1no data
💼 PCI DSS v4.0 → 💼 12.3.4 Hardware and software technologies in use are reviewed at least once every 12 months.1no data