# Ensure Lambda functions do not use obsolete runtimes - Source: https://support.icompaas.com/support/solutions/articles/a_1793292189074168-ensure-lambda-functions-do-not-use-obsolete-runtimes - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that no AWS Lambda function uses an obsolete runtime: java8, go1.x, provided, python2.7, python3.6, python3.7, python3.8, nodejs, nodejs4.3, nodejs4.3-edge, nodejs6.10, nodejs8.10, nodejs10.x, nodejs12.x, nodejs14.x, nodejs16.x, dotnet5.0, dotnet6, dotnet7, dotnetcore1.0, dotnetcore2.0, dotnetcore2.1, dotnetcore3.1, ruby2.5 and ruby2.7. Container image functions are not evaluated, and runtimes not on this list pass. **Rationale** Deprecated runtimes no longer receive security patches, so the function code and its libraries remain exposed to known vulnerabilities. After deprecation, AWS also blocks the creation and later the update of functions that use the runtime, which can break deployments and slow down recovery from incidents. Moving functions to a supported runtime, testing the change before release and keeping dependencies up to date keeps the functions patched and deployable. **Impact** - Keeps the function on a runtime that receives security patches and AWS support - Avoids deployment failures once AWS blocks updates to functions on deprecated runtimes - Upgrading the runtime may require code and dependency changes, so the function must be tested before the change is released **Default Value** There is no default runtime. The runtime is chosen when a function is created and does not change automatically to a new major version. **Pre-Requisites** - IAM permissions: lambda:ListFunctions, lambda:GetFunctionConfiguration, lambda:UpdateFunctionConfiguration and lambda:UpdateFunctionCode - A version of the function code and dependencies that has been tested on the target runtime - A test or staging environment, and a plan for publishing versions or aliases to allow a quick rollback **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Lambda console and select **Functions**. 3. Check the **Runtime** column of each function (or the **Runtime settings** section in the function's **Code** tab). 4. Repeat for each region in use. 5. If any function uses one of the obsolete runtimes listed in the description, follow the implementation steps. **CLI:** List the functions and their runtimes: aws lambda list-functions --region --query "Functions\[\].\[FunctionName,Runtime,PackageType\]" --output table A function fails if its Runtime is one of the obsolete runtimes listed in the description. Functions with no runtime (container images) are not evaluated. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Lambda console and select the function. 3. If needed, update and deploy the function code so that it is compatible with the new runtime. 4. In the **Code** tab, go to **Runtime settings** and choose **Edit**. 5. In **Runtime**, select a supported runtime (for example, the latest version of the same language). 6. Choose **Save** and test the function. 7. Repeat for each affected function in each region in use. **CLI:** Change the function runtime, for example to python3.12: aws lambda update-function-configuration --region --function-name --runtime **Backout Plan** Before making changes, save the current function configuration: aws lambda get-function-configuration --region --function-name > function-configuration-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Lambda console and select the function. 3. In the **Code** tab, go to **Runtime settings** and choose **Edit**. 4. Select the previous runtime from the saved backup and choose **Save**. 5. If the code was changed, deploy the previous code, or point the alias back to the previous published version. **CLI:** aws lambda update-function-configuration --region --function-name --runtime Note: AWS may block changing a function back to a deprecated runtime. Rolling back to a previously published version or alias is the more reliable option, and it leaves the function on an unpatched runtime. **Reference** - [https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html) - [https://docs.aws.amazon.com/lambda/latest/dg/runtime-support-policy.html](https://docs.aws.amazon.com/lambda/latest/dg/runtime-support-policy.html) - [https://aws.amazon.com/blogs/compute/managing-aws-lambda-runtime-upgrades/](https://aws.amazon.com/blogs/compute/managing-aws-lambda-runtime-upgrades/) - [https://docs.aws.amazon.com/cli/latest/reference/lambda/update-function-configuration.html](https://docs.aws.amazon.com/cli/latest/reference/lambda/update-function-configuration.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.