Back to Checks
aws

Lambda function has a Dead Letter Queue configured

awslambda_function_no_dead_letter_queue
Service: awslambdaSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsLambdaFunction

AWS Lambda functions have a Dead Letter Queue (DLQ) configured — an SQS queue or SNS topic that receives records of failed asynchronous invocations.

Without a DLQ, failed invocations are silently discarded after exhausting retries.

Prowler logoProwlerprowler-provider-aws

Risk

Without a DLQ, failed asynchronous invocations are permanently lost. This harms availability by hiding processing failures, and weakens integrity by making it impossible to replay or audit unprocessed events.

In security-sensitive pipelines (e.g., audit log processors, alerting functions), silent failure can mask security events entirely.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks awslambda_function_no_dead_letter_queue

Recommendation

Configure a Dead Letter Queue for every Lambda function that handles asynchronous invocations.

  • Prefer an SQS queue as the DLQ target for retry and replay capability
  • Ensure the Lambda execution role has sqs:SendMessage permission on the DLQ
  • Monitor DLQ depth with a CloudWatch alarm to alert on processing failures

Remediation

CLI

aws lambda update-function-configuration --function-name <function-name> --dead-letter-config TargetArn=<sqs-queue-arn-or-sns-topic-arn>

Terraform

resource "aws_lambda_function" "example" {
  function_name = "<example_resource_name>"
  role          = "<example_role_arn>"
  handler       = "index.handler"
  runtime       = "python3.12"
  filename      = "<example_package.zip>"

  dead_letter_config {
    target_arn = "<sqs-queue-arn-or-sns-topic-arn>"
  }
}

NativeIaC

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: <example_resource_name>
      Role: <example_role_arn>
      Handler: index.handler
      Runtime: python3.12
      Code:
        S3Bucket: <example_code_bucket>
        S3Key: <example_code_key>
      DeadLetterConfig:
        TargetArn: <sqs-queue-arn-or-sns-topic-arn>

Other

1Open the AWS Lambda console and select your function
2Go to Configuration > Asynchronous invocation
3Under Dead-letter queue service, select SQS or SNS
4Choose or create the target queue/topic
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.awslambda.awslambda_client import awslambda_client


class awslambda_function_no_dead_letter_queue(Check):
    def execute(self):
        findings = []
        for function in awslambda_client.functions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=function)
            if function.dead_letter_config:
                report.status = "PASS"
                report.status_extended = f"Lambda function {function.name} has a Dead Letter Queue configured at {function.dead_letter_config.target_arn}."
            else:
                report.status = "FAIL"
                report.status_extended = f"Lambda function {function.name} does not have a Dead Letter Queue configured."
            findings.append(report)
        return findings

References