Check ID: awslambda_function_using_supported_runtimes
Provider: AWS
Service: awslambda
Severity: MEDIUM
Resource type: AwsLambdaFunction

What this check verifies

Lambda functions using obsolete runtimes-such as python3.8, nodejs14.x, go1.x, ruby2.7-are identified against a curated list of deprecated runtime identifiers.

Risk

Unmaintained runtimes lack security patches, exposing code and libraries to known CVEs (confidentiality, integrity). Deprecation can block create/update and break builds, causing failed deployments or runtime errors (availability). Tooling may stop supporting builds, slowing fixes and recovery.

Recommendation

Upgrade to supported LTS runtimes (AL2/AL2023) and include runtime upgrades in a secure SDLC. Test in staging, deploy via versions/aliases, and keep dependencies current. Monitor deprecation notices. Apply guardrails to block deprecated runtime values and allow only approved runtimes, aligning with defense in depth.

Remediation

aws lambda update-function-configuration —function-name <FUNCTION_NAME> —runtime <SUPPORTED_RUNTIME>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = awslambda_function_using_supported_runtimes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks