Control: AWS > Lambda > Function > Allowed Runtime

Take an action when an AWS > Lambda > Function is not using the desired runtime.

This control checks the function's runtime against the list of allowed runtimes in the AWS > Lambda > Function > Allowed Runtime > Values policy. When enforcement is enabled via the AWS > Lambda > Function > Allowed Runtime policy, the function is upgraded to the runtime defined in the AWS > Lambda > Function > Allowed Runtime > Target Runtime policy — even if its current runtime is allowed. Only a function of the same language as the target runtime is upgraded; otherwise the function is simply checked against the allowed runtimes.

For any enforcement actions that specify if new, e.g., Enforce: Upgrade to Target Runtime if new, this control will only take the enforcement actions for functions created within the last 60 minutes. A function's creation time is only recorded when the function is created while real-time event handling is enabled; functions recorded by the AWS > Lambda > Function > Discovery control have no creation time and are checked but never acted on.