Lambda function is using a deprecated or end-of-life runtime
- Severity
- High
- Service
- Lambda
- Check ID
- LAMBDA_DEPRECATED_RUNTIME
What this check finds
AWS no longer applies security patches to deprecated runtimes. Functions running on EOL runtimes (e.g. Python 3.6, Node.js 14.x, Go 1.x) are exposed to known CVEs without the possibility of a platform-level fix. AWS will eventually block deployment and invocation of functions on deprecated runtimes.
Passing looks like: Lambda runtimes are supported.
How to fix it
Update the Lambda function to a supported runtime.
AWS CLI
aws lambda update-function-configuration --function-name FUNCTION_NAME --runtime python3.12
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
Lambda → Functions → select function → Runtime settings → Edit → Runtime → select a supported version. Test thoroughly before updating production functions.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| PCI-DSS v4.0.1 |
|
| HIPAA Security Rule |
|
| SOC 2 — Trust Services Criteria |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs