AWS lambda documentation change
Summary
Clarified recursion loop behavior when opting out of detection, emphasizing risks of unmitigated loops.
Security assessment
Adds documentation about the security implications of disabling recursion detection, which helps users avoid unintended resource exhaustion. While not fixing a specific vulnerability, it enhances security guidance.
Diff
diff --git a/lambda/latest/dg/invocation-recursion.md index e30f4d0ce..96520f759 100644 --- a/lambda/latest/dg/invocation-recursion.md +++ b/lambda/latest/dg/invocation-recursion.md @@ -48 +48 @@ Even when the `maxReceiveCount` setting on the source queue's redrive policy is -If you have an [on-failure destination](./invocation-async-retain-records.html#invocation-async-destinations) or [dead-letter queue](./invocation-async-retain-records.html#invocation-dlq) configured for your function, then Lambda also sends the event from the stopped invocation to your destination or dead-letter queue. When configuring a destination or dead-letter queue for your function, be sure not to use an Amazon SNS topic or Amazon SQS queue that your function also uses as an event trigger or event source mapping. If you send events to the same resource that invokes your function, then you can create another recursive loop. +If you have an [on-failure destination](./invocation-async-retain-records.html#invocation-async-destinations) or [dead-letter queue](./invocation-async-retain-records.html#invocation-dlq) configured for your function, then Lambda also sends the event from the stopped invocation to your destination or dead-letter queue. When configuring a destination or dead-letter queue for your function, be sure not to use an event trigger or event source mapping that your function also uses. If you send events to the same resource that invokes your function, then you can create another recursive loop and this loop will also be terminated. If you opt out of recursion loop detection, this loop will not be terminated.