| name | cis-aws-compute-12.11 |
| description | Ensure that the runtime environment versions used for your Lambda functions do not have end of support dates |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","lambda","serverless","runtime","eol","patching","deprecation"] |
| cis_id | 12.11 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-12.8","cis-aws-compute-12.12"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure that the runtime environment versions used for your Lambda functions do not have end of support dates
Description
Always using a recent version of the execution environment configured for your Amazon Lambda functions adheres to best practices for the newest software features, the latest security patches and bug fixes, and performance and reliability.
Rationale
When you execute your Lambda functions using recent versions of the implemented runtime environment, you should benefit from new features and enhancements, better security, along with performance and reliability.
Impact
Upgrading runtime versions may introduce breaking changes. Functions should be thoroughly tested with the new runtime before deployment.
Audit Procedure
Using AWS Console
- Login to the AWS Console using https://console.aws.amazon.com/lambda/.
- In the left column, under
AWS Lambda, click Functions.
- Under
Function name click on the name of the function that you want to review
- Click Code tab
- In the Runtime settings section, check the Runtime attribute value to determine the runtime version.
- Compare the function runtime with the updated list of Amazon Lambda runtimes. Link is in the resource section.
- If the version you are using is not the latest or is on the EOL list, the selected Amazon Lambda function is using an old and deprecated runtime environment.
- Refer to the remediation below.
- Repeat steps 2-6 for each Lambda function within the current region.
Then repeat the Audit process for all other regions.
Using AWS CLI
- Run
aws lambda list-functions
aws lambda list-functions --output table --query 'Functions[*].FunctionName'
This command will provide a table titled ListFunctions
- Run
aws lambda get-function-configuration using the Function names returned in the table.
aws lambda get-function-configuration --function-name "name_of_fuunction" --query 'Runtime'
- The command output should return the execution environment.
- Compare the function runtime with the updated list of Amazon Lambda runtimes. Link is in the resource section.
- If the version you are using is not the latest or is on the EOL list, the selected Amazon Lambda function is using an old and deprecated runtime environment.
