AWS Security Hub · Lambda
Lambda.2: Lambdas run on deprecated, unpatched runtimes
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub Lambda.2 check?
Lambda.2 fails when a function runs on a runtime AWS has deprecated: an older Node.js, Python or other version that is past its supported window.
Why does Lambda.2 matter?
AWS gives at least 180 days' notice before a runtime is deprecated, then blocks new function creation at least 30 days after deprecation and blocks function updates at least 60 days after, but teams routinely miss the email and Trusted Advisor alerts and only react once updates are blocked. You can still upgrade a deprecated function to a supported runtime at any time by changing its runtime identifier with `update-function-configuration`, which keeps the function ARN, so invokers and IAM policies stay intact. The real cost is that a deprecated runtime stops receiving security patches and is no longer eligible for support, and once function updates are blocked you can't revert to it, so a 30-minute runtime bump left until the last window turns into a rushed migration under a hard deadline.
How do I fix Lambda.2?
- List all functions by runtime to find those on deprecated or soon-to-be-deprecated versions.
- Bump each function to a supported runtime, testing for the breaking changes that come with minor bumps (Node's `fetch`, Python's `ssl`).
- For functions pinned by a custom runtime layer to an old Amazon Linux base, rebuild the layer on a current base.
- Track the published deprecation schedule and upgrade well before a runtime stops being updateable.
Remediation script · bash
# Enable auto minor version upgrade on every RDS instance that has it disabled.
for id in $(aws rds describe-db-instances \
--query 'DBInstances[?AutoMinorVersionUpgrade==`false`].DBInstanceIdentifier' --output text); do
aws rds modify-db-instance --db-instance-identifier "$id" \
--auto-minor-version-upgrade --no-apply-immediately
done
# Move a deprecated Lambda function to a supported runtime.
aws lambda update-function-configuration --function-name auth-token-issuer \
--runtime nodejs22.x
# Upgrade an out-of-support EKS control plane one minor version at a time (then catch up node groups).
aws eks update-cluster-version --name prod-payments --kubernetes-version 1.29Full walkthrough (console steps, edge cases and verification) in the lesson Keep software and engines patched.
Is Lambda.2 a false positive?
The control's supported-runtime list is a fixed parameter Security Hub maintains, so a function can fail transiently right after AWS ships a brand-new runtime: your function is on a current, fully supported version, but the control's list hasn't caught up yet. The fail clears on its own once the parameter is updated, so suppress it for that window rather than rolling back. Note too that the check ignores container-image functions (package type `Image`), so a function pinned to an old base image won't be flagged here at all. That is the control's scope, not a defect, and such images need their own patching cadence outside this finding.