Back to Checks
aws

Lambda function uses a supported runtime

awslambda_function_using_supported_runtimes
Service: awslambdaSeverity: medium
OfficialBuilt-inVerified
Resource Type:AwsLambdaFunction

Lambda functions using obsolete runtimes-such as python3.8, nodejs14.x, go1.x, ruby2.7-are identified against a curated list of deprecated runtime identifiers.

Prowler logoProwlerprowler-provider-aws

Risk

Unmaintained runtimes lack security patches, exposing code and libraries to known CVEs (confidentiality, integrity).

Deprecation can block create/update and break builds, causing failed deployments or runtime errors (availability). Tooling may stop supporting builds, slowing fixes and recovery.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks awslambda_function_using_supported_runtimes

Recommendation

Upgrade to supported LTS runtimes (AL2/AL2023) and include runtime upgrades in a secure SDLC.

Test in staging, deploy via versions/aliases, and keep dependencies current. Monitor deprecation notices. Apply guardrails to block deprecated runtime values and allow only approved runtimes, aligning with defense in depth.

Remediation

CLI

aws lambda update-function-configuration --function-name <FUNCTION_NAME> --runtime <SUPPORTED_RUNTIME>

Terraform

# Set Lambda to a supported runtime
resource "aws_lambda_function" "<example_resource_name>" {
  function_name = "<example_resource_name>"
  role          = "<example_role_arn>"
  handler       = "<example_handler>"
  runtime       = "<SUPPORTED_RUNTIME>" # FIX: use a supported runtime (e.g., python3.12) to pass the check
  filename      = "<example_package.zip>"
}

NativeIaC

# CloudFormation: set Lambda to a supported runtime
Resources:
  <example_resource_name>:
    Type: AWS::Lambda::Function
    Properties:
      Role: <example_role_arn>
      Handler: <example_handler>
      Runtime: <SUPPORTED_RUNTIME>  # FIX: change to a supported runtime (e.g., python3.12) to pass the check
      Code:
        S3Bucket: <example_bucket_name>
        S3Key: <example_object_key>

Other

1Open the AWS Lambda console and select the function
2Go to Configuration > Runtime settings > Edit
3In Runtime, choose a supported runtime (e.g., python3.12) and click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.awslambda.awslambda_client import awslambda_client

default_obsolete_lambda_runtimes = [
    "java8",
    "go1.x",
    "provided",
    "python3.6",
    "python2.7",
    "python3.7",
    "python3.8",
    "nodejs4.3",
    "nodejs4.3-edge",
    "nodejs6.10",
    "nodejs",
    "nodejs8.10",
    "nodejs10.x",
    "nodejs12.x",
    "nodejs14.x",
    "nodejs16.x",
    "dotnet5.0",
    "dotnet6",
    "dotnet7",
    "dotnetcore1.0",
    "dotnetcore2.0",
    "dotnetcore2.1",
    "dotnetcore3.1",
    "ruby2.5",
    "ruby2.7",
]


class awslambda_function_using_supported_runtimes(Check):
    def execute(self):
        findings = []
        for function in awslambda_client.functions.values():
            if function.runtime:
                report = Check_Report_AWS(metadata=self.metadata(), resource=function)

                if function.runtime in awslambda_client.audit_config.get(
                    "obsolete_lambda_runtimes", default_obsolete_lambda_runtimes
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Lambda function {function.name} is using {function.runtime} which is obsolete."
                else:
                    report.status = "PASS"
                    report.status_extended = f"Lambda function {function.name} is using {function.runtime} which is supported."

                findings.append(report)

        return findings

References