Description

Ensure that no AWS Lambda function uses an obsolete runtime: java8, go1.x, provided, python2.7, python3.6, python3.7, python3.8, nodejs, nodejs4.3, nodejs4.3-edge, nodejs6.10, nodejs8.10, nodejs10.x, nodejs12.x, nodejs14.x, nodejs16.x, dotnet5.0, dotnet6, dotnet7, dotnetcore1.0, dotnetcore2.0, dotnetcore2.1, dotnetcore3.1, ruby2.5 and ruby2.7. Container image functions are not evaluated, and runtimes not on this list pass.

Rationale

Deprecated runtimes no longer receive security patches, so the function code and its libraries remain exposed to known vulnerabilities. After deprecation, AWS also blocks the creation and later the update of functions that use the runtime, which can break deployments and slow down recovery from incidents. Moving functions to a supported runtime, testing the change before release and keeping dependencies up to date keeps the functions patched and deployable.

Impact

  • Keeps the function on a runtime that receives security patches and AWS support

  • Avoids deployment failures once AWS blocks updates to functions on deprecated runtimes

  • Upgrading the runtime may require code and dependency changes, so the function must be tested before the change is released

Default Value

There is no default runtime. The runtime is chosen when a function is created and does not change automatically to a new major version.

Pre-Requisites

  • IAM permissions: lambda:ListFunctions, lambda:GetFunctionConfiguration, lambda:UpdateFunctionConfiguration and lambda:UpdateFunctionCode

  • A version of the function code and dependencies that has been tested on the target runtime

  • A test or staging environment, and a plan for publishing versions or aliases to allow a quick rollback

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Lambda console and select Functions.

  3. Check the Runtime column of each function (or the Runtime settings section in the function's Code tab).

  4. Repeat for each region in use.

  5. If any function uses one of the obsolete runtimes listed in the description, follow the implementation steps.

CLI:

List the functions and their runtimes:

aws lambda list-functions --region <REGION> --query "Functions[].[FunctionName,Runtime,PackageType]" --output table

A function fails if its Runtime is one of the obsolete runtimes listed in the description. Functions with no runtime (container images) are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Lambda console and select the function.

  3. If needed, update and deploy the function code so that it is compatible with the new runtime.

  4. In the Code tab, go to Runtime settings and choose Edit.

  5. In Runtime, select a supported runtime (for example, the latest version of the same language).

  6. Choose Save and test the function.

  7. Repeat for each affected function in each region in use.

CLI:

Change the function runtime, for example to python3.12:

aws lambda update-function-configuration --region <REGION> --function-name <FUNCTION_NAME> --runtime <SUPPORTED_RUNTIME>

Backout Plan

Before making changes, save the current function configuration:

aws lambda get-function-configuration --region <REGION> --function-name <FUNCTION_NAME> > function-configuration-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Lambda console and select the function.

  3. In the Code tab, go to Runtime settings and choose Edit.

  4. Select the previous runtime from the saved backup and choose Save.

  5. If the code was changed, deploy the previous code, or point the alias back to the previous published version.

CLI:

aws lambda update-function-configuration --region <REGION> --function-name <FUNCTION_NAME> --runtime <PREVIOUS_RUNTIME>

Note: AWS may block changing a function back to a deprecated runtime. Rolling back to a previously published version or alias is the more reliable option, and it leaves the function on an unpatched runtime.

Reference