AWS lambda high security documentation change
Summary
Updated runtime deprecation timeline with phased approach, extended notice periods (180 days), and clearer migration guidance. Added details about blocked operations phases and emphasized security update discontinuation.
Security assessment
Explicitly states AWS may stop applying security updates to deprecated runtimes, which could leave functions vulnerable. Highlights certificate expiry risks and recommends migration to maintain security patches. The change adds documentation about security implications of runtime deprecation.
Diff
diff --git a/lambda/latest/dg/lambda-runtimes.md b/lambda/latest/dg/lambda-runtimes.md index 25ff1cb97..acf2f4b6d 100644 --- a//lambda/latest/dg/lambda-runtimes.md +++ b//lambda/latest/dg/lambda-runtimes.md @@ -124 +124 @@ Container image approaching deprecation | Deprecation notifications are not ava -After a runtime is deprecated, AWS may no longer apply security patches or updates to that runtime, and functions using that runtime are no longer eligible for technical support. Such deprecated runtimes are provided ‘as-is’, without any warranties, and may contain bugs, errors, defects, or other vulnerabilities. Functions that use a deprecated runtime may also experience degraded performance or other issues, such as a certificate expiry, that can cause them to stop working properly. +After a runtime is deprecated, AWS may no longer apply security patches or updates to that runtime, and functions using that runtime are no longer eligible for technical support. While you can continue to invoke your functions indefinitely, AWS strongly recommends migrating to a supported runtime. Deprecated runtimes are provided 'as-is', without any warranties, and may contain bugs, errors, defects, or other vulnerabilities. Functions that use a deprecated runtime may also experience degraded performance or other issues, such as a certificate expiry, that can cause them to stop working properly. @@ -126 +126 @@ After a runtime is deprecated, AWS may no longer apply security patches or updat -For at least 30 days after a runtime is deprecated, you’re still able to create new Lambda functions using that runtime. Starting from 30 days after deprecation, Lambda begins blocking the creation of new functions. +You can update a function to use a newer supported runtime at any time after a runtime is deprecated. We recommend testing your function with the new runtime before applying changes in production environments. You will not be able to revert to the deprecated runtime after function updates are blocked. We recommend using function [versions](./configuration-versions.html) and [aliases](./configuration-aliases.html) to enable safe deployment with rollback. @@ -128 +128,16 @@ For at least 30 days after a runtime is deprecated, you’re still able to creat -For at least 60 days after a runtime is deprecated, you’re still able to update function code and configuration for existing functions. Starting from 60 days after deprecation, Lambda begins blocking the update of function code and configuration for existing functions. +The following timeline describes what happens when a runtime is deprecated: + +Runtime lifecycle phase | When | What +---|---|--- +Deprecation notice period | At least 180 days before deprecation | + + * AWS sends notifications through email and the AWS Health Dashboard to accounts that have functions using this runtime in their `$LATEST` version. + * Affected functions are also listed in the [AWS Health Dashboard Scheduled changes tab](https://docs.aws.amazon.com/health/latest/ug/aws-health-account-views.html) and the [AWS Trusted Advisor deprecated runtimes check](https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html#aws-lambda-functions-deprecated-runtimes). + + +Deprecation | Deprecation date | + + * AWS may no longer apply security updates or other updates. + * Functions are no longer eligible for technical support. + * You can no longer create new functions using the deprecated runtime in the Lambda console. + * You can continue to create functions through the AWS CLI, AWS SAM, or AWS CloudFormation. @@ -130 +144,0 @@ For at least 60 days after a runtime is deprecated, you’re still able to updat -###### Note @@ -132 +146 @@ For at least 60 days after a runtime is deprecated, you’re still able to updat -For some runtimes, AWS is delaying the block-function-create and block-function-update dates beyond the usual 30 and 60 days after deprecation. AWS has made this change in response to customer feedback to give you more time to upgrade your functions. Refer to the tables in Supported runtimes and Deprecated runtimes to see the dates for your runtime. +Block function create | At least 30 days after deprecation | @@ -134 +148,2 @@ For some runtimes, AWS is delaying the block-function-create and block-function- -You can update a function to use a newer supported runtime indefinitely after a runtime is deprecated. You should test that your function works with the new runtime before applying the runtime change in production environments, since you will not be able to revert to the deprecated runtime once the 60-day period has passed. We recommend using function [versions](./configuration-versions.html) and [aliases](./configuration-aliases.html) to enable safe deployment with rollback. + * Lambda begins blocking creation of new functions. + * You can continue to update code and configuration for existing functions. @@ -136 +150,0 @@ You can update a function to use a newer supported runtime indefinitely after a -Note that the exact length of time for which you can continue to create and update functions isn’t fixed. This period can vary for each deprecation and for different AWS Regions. Nominal dates for the blocking of function creates and updates are provided in the Supported Runtimes table in the first section of this page. Lambda will not start blocking function creates or updates before the dates given in this table. @@ -138 +152,10 @@ Note that the exact length of time for which you can continue to create and upda -You can continue to invoke your functions indefinitely after the runtime is deprecated. However, AWS strongly recommends that you migrate functions to a supported runtime so that your functions continue to receive security patches and remain eligible for technical support. +Block function update | At least 60 days after deprecation | + + * Lambda begins blocking the update of code and configuration for existing functions. + * You can still upgrade the function configuration to a supported runtime. However, rolling back to the deprecated runtime may be blocked. + + + +###### Note + +For some runtimes, AWS is delaying the block-function-create and block-function-update dates beyond the usual 30 and 60 days after deprecation. AWS has made this change in response to customer feedback to give you more time to upgrade your functions. Refer to the tables in Supported runtimes and Deprecated runtimes to see the dates for your runtime. Lambda will not start blocking function creates or updates before the dates given in these tables.