AWS AWSCloudFormation documentation change
Summary
Added detailed documentation for Lambda runtime management policies, including secure update modes.
Security assessment
The changes explain how to enforce secure runtime updates (e.g., automatic updates to the 'most recent and secure runtime version'), which is a security best practice. However, this does not address a specific disclosed vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-version-runtimepolicy.md b/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-version-runtimepolicy.md index e292646c9..27ef1e2eb 100644 --- a//AWSCloudFormation/latest/UserGuide/aws-properties-lambda-version-runtimepolicy.md +++ b//AWSCloudFormation/latest/UserGuide/aws-properties-lambda-version-runtimepolicy.md @@ -7 +7 @@ SyntaxProperties -The `RuntimePolicy` property type specifies Property description not available. for an [AWS::Lambda::Version](./aws-resource-lambda-version.html). +Sets the runtime management configuration for a function's version. For more information, see [Runtime updates](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html). @@ -34 +34,5 @@ To declare this entity in your AWS CloudFormation template, use the following sy -Property description not available. +The ARN of the runtime version you want the function to use. + +###### Note + +This is only required if you're using the **Manual** runtime update mode. @@ -51 +55,12 @@ _Minimum_ : `26` -Property description not available. +Specify the runtime update mode. + + * **Auto (default)** \- Automatically update to the most recent and secure runtime version using a [Two-phase runtime version rollout](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-two-phase). This is the best choice for most customers to ensure they always benefit from runtime updates. + + * **FunctionUpdate** \- Lambda updates the runtime of you function to the most recent and secure runtime version when you update your function. This approach synchronizes runtime updates with function deployments, giving you control over when runtime updates are applied and allowing you to detect and mitigate rare runtime update incompatibilities early. When using this setting, you need to regularly update your functions to keep their runtime up-to-date. + + * **Manual** \- You specify a runtime version in your function configuration. The function will use this runtime version indefinitely. In the rare case where a new runtime version is incompatible with an existing function, this allows you to roll back your function to an earlier runtime version. For more information, see [Roll back a runtime version](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-rollback). + + + + +_Valid Values_ : `Auto` | `FunctionUpdate` | `Manual`