Check ID:
Provider: AWS
Service:
Severity: MEDIUM
Resource type:
awslambda_function_using_supported_runtimesProvider: AWS
Service:
awslambdaSeverity: MEDIUM
Resource type:
AwsLambdaFunctionWhat this check verifies
Lambda functions using obsolete runtimes-such aspython3.8, nodejs14.x, go1.x, ruby2.7-are identified against a curated list of deprecated runtime identifiers.
Risk
Unmaintained runtimes lack security patches, exposing code and libraries to known CVEs (confidentiality, integrity). Deprecation can block create/update and break builds, causing failed deployments or runtime errors (availability). Tooling may stop supporting builds, slowing fixes and recovery.Recommendation
Upgrade to supported LTS runtimes (AL2/AL2023) and include runtime upgrades in a secure SDLC. Test in staging, deploy via versions/aliases, and keep dependencies current. Monitor deprecation notices. Apply guardrails to block deprecatedruntime values and allow only approved runtimes, aligning with defense in depth.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
aws lambda update-function-configuration —function-name <FUNCTION_NAME> —runtime <SUPPORTED_RUNTIME>
References
- https://aws.amazon.com/blogs/compute/managing-aws-lambda-runtime-upgrades/
- https://docs.aws.amazon.com/lambda/latest/dg/runtime-support-policy.html
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/Lambda/supported-runtime-environment.html
- https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = awslambda_function_using_supported_runtimes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks