Lambda function has a Dead Letter Queue configured

Check ID: awslambda_function_no_dead_letter_queue
Provider: AWS
Service: awslambda
Severity: MEDIUM
Categories: resilience
Resource type: AwsLambdaFunction

What this check verifies

AWS Lambda functions have a Dead Letter Queue (DLQ) configured — an SQS queue or SNS topic that receives records of failed asynchronous invocations. Without a DLQ, failed invocations are silently discarded after exhausting retries.

Risk

Without a DLQ, failed asynchronous invocations are permanently lost. This harms availability by hiding processing failures, and weakens integrity by making it impossible to replay or audit unprocessed events. In security-sensitive pipelines (e.g., audit log processors, alerting functions), silent failure can mask security events entirely.

Recommendation

Configure a Dead Letter Queue for every Lambda function that handles asynchronous invocations.

Prefer an SQS queue as the DLQ target for retry and replay capability
Ensure the Lambda execution role has sqs:SendMessage permission on the DLQ
Monitor DLQ depth with a CloudWatch alarm to alert on processing failures

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws lambda update-function-configuration --function-name <function-name> --dead-letter-config TargetArn=<sqs-queue-arn-or-sns-topic-arn>

resource "aws_lambda_function" "example" {
  function_name = "<example_resource_name>"
  role          = "<example_role_arn>"
  handler       = "index.handler"
  runtime       = "python3.12"
  filename      = "<example_package.zip>"

  dead_letter_config {
    target_arn = "<sqs-queue-arn-or-sns-topic-arn>"
  }
}

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: <example_resource_name>
      Role: <example_role_arn>
      Handler: index.handler
      Runtime: python3.12
      Code:
        S3Bucket: <example_code_bucket>
        S3Key: <example_code_key>
      DeadLetterConfig:
        TargetArn: <sqs-queue-arn-or-sns-topic-arn>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = awslambda_function_no_dead_letter_queue. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Lambda function Invoke API calls are recorded by CloudTrail Lambda function code contains no hardcoded secrets

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires