For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/zbs-gp9-gp2.md. A documentation index is available at /llms.txt.

Lambda function should use the latest runtime environment version

lambda

Description

This control ensures that your Amazon Lambda Function is updated to the most recent production runtime environment version. It passes only for these runtimes: nodejs24.x, python3.14, java25, dotnet10, ruby4.0, and provided.al2023. Preview runtimes are excluded because AWS does not cover them under the Lambda SLA or Technical Support and advises against using them for production workloads. Regularly updating your Lambda functions to the latest runtime version is a best practice recommended by Amazon to incorporate security patches, bug fixes, and the latest features.

Note: AWS Lambda supports deployment via both container images and .zip file archives. For container images, the runtime is determined during base image creation and is not accessible through configuration data. This is consistent for AWS and Custom base images. Consequently, this check only applies to deployment packages of the Zip type.

For details on supported and recent runtimes, see AWS Lambda Supported Runtimes.

Remediation

To learn how to update your Lambda function’s runtime, refer to the AWS Console Documentation.