diff --git a/checkov/cloudformation/checks/resource/aws/DeprecatedLambdaRuntime.py b/checkov/cloudformation/checks/resource/aws/DeprecatedLambdaRuntime.py index 7f25650c40..c7f3707a05 100644 --- a/checkov/cloudformation/checks/resource/aws/DeprecatedLambdaRuntime.py +++ b/checkov/cloudformation/checks/resource/aws/DeprecatedLambdaRuntime.py @@ -20,11 +20,7 @@ def get_forbidden_values(self) -> List[Any]: return ["dotnetcore3.1", "nodejs12.x", "python3.6", "python2.7", "dotnet5.0", "dotnetcore2.1", "ruby2.5", "nodejs10.x", "nodejs8.10", "nodejs4.3", "nodejs6.10", "dotnetcore1.0", "dotnetcore2.0", "nodejs4.3-edge", "nodejs", "java8", "python3.7", "go1.x", "provided", "ruby2.7", "nodejs14.x", - "nodejs16.x", "python3.9", "dotnet7", "dotnet6" - # , "nodejs18.x" # Uncomment on Sept 1, 2025 - # , "provided.al2" # Uncomment on Jun 30, 2026 - # , "python3.9" # Uncomment on Nov 3, 2025 - ] + "nodejs16.x", "nodejs18.x", "python3.9", "dotnet7", "dotnet6"] check = DeprecatedLambdaRuntime() diff --git a/checkov/terraform/checks/resource/aws/DeprecatedLambdaRuntime.py b/checkov/terraform/checks/resource/aws/DeprecatedLambdaRuntime.py index b2114a6ff3..58273e00ff 100644 --- a/checkov/terraform/checks/resource/aws/DeprecatedLambdaRuntime.py +++ b/checkov/terraform/checks/resource/aws/DeprecatedLambdaRuntime.py @@ -20,11 +20,7 @@ def get_forbidden_values(self) -> List[Any]: return ["dotnetcore3.1", "nodejs12.x", "python3.6", "python2.7", "dotnet5.0", "dotnetcore2.1", "ruby2.5", "nodejs10.x", "nodejs8.10", "nodejs4.3", "nodejs6.10", "dotnetcore1.0", "dotnetcore2.0", "nodejs4.3-edge", "nodejs", "java8", "python3.7", "go1.x", "provided", "ruby2.7", "nodejs14.x", - "nodejs16.x", "python3.9", "dotnet7", "dotnet6" - # , "nodejs18.x" # Uncomment on Sept 1, 2025 - # , "provided.al2" # Uncomment on Jun 30, 2026 - # , "python3.9" # Uncomment on Nov 3, 2025 - ] + "nodejs16.x", "nodejs18.x", "python3.9", "dotnet7", "dotnet6"] check = DeprecatedLambdaRuntime() diff --git a/tests/cloudformation/checks/resource/aws/example_DeprecatedLambdaRuntime/example.yaml b/tests/cloudformation/checks/resource/aws/example_DeprecatedLambdaRuntime/example.yaml index 5e4fd40144..192d5c416d 100644 --- a/tests/cloudformation/checks/resource/aws/example_DeprecatedLambdaRuntime/example.yaml +++ b/tests/cloudformation/checks/resource/aws/example_DeprecatedLambdaRuntime/example.yaml @@ -4,11 +4,11 @@ Resources: Properties: Handler: 'index.handler' Role: 'arn:aws:iam::123456789012:role/execution_role' - FunctionName: 'MyFunction' + FunctionName: 'MyFunctionPass' Code: S3Bucket: 'myBucket' S3Key: 'code/myLambda.zip' - Runtime: 'nodejs18.x' + Runtime: 'python3.11' Fail: Type: 'AWS::Lambda::Function' Metadata: @@ -20,7 +20,7 @@ Resources: Properties: Handler: 'index.handler' Role: 'arn:aws:iam::123456789012:role/execution_role' - FunctionName: 'MyFunction' + FunctionName: 'MyFunctionFail' Code: S3Bucket: 'myBucket' S3Key: 'code/myLambda.zip' diff --git a/tests/terraform/checks/resource/aws/example_DeprecatedLambdaRuntime/main.tf b/tests/terraform/checks/resource/aws/example_DeprecatedLambdaRuntime/main.tf index 4c23bf0135..97655a9da1 100644 --- a/tests/terraform/checks/resource/aws/example_DeprecatedLambdaRuntime/main.tf +++ b/tests/terraform/checks/resource/aws/example_DeprecatedLambdaRuntime/main.tf @@ -3,7 +3,7 @@ resource "aws_lambda_function" "pass" { function_name = "lambda_function_name" role = aws_iam_role.iam_for_lambda.arn handler = "index.test" - runtime = "nodejs18.x" + runtime = "python3.11" ephemeral_storage { size = 10240 # Min 512 MB and the Max 10240 MB @@ -29,6 +29,18 @@ resource "aws_lambda_function" "fail2" { handler = "index.test" runtime = "dotnetcore3.1" + ephemeral_storage { + size = 10240 # Min 512 MB and the Max 10240 MB + } +} + +resource "aws_lambda_function" "fail3" { + filename = "lambda_function_payload.zip" + function_name = "lambda_function_name" + role = aws_iam_role.iam_for_lambda.arn + handler = "index.test" + runtime = "nodejs18.x" + ephemeral_storage { size = 10240 # Min 512 MB and the Max 10240 MB } diff --git a/tests/terraform/checks/resource/aws/test_DeprecatedLambdaRuntime.py b/tests/terraform/checks/resource/aws/test_DeprecatedLambdaRuntime.py index 1851884367..e447b45d77 100644 --- a/tests/terraform/checks/resource/aws/test_DeprecatedLambdaRuntime.py +++ b/tests/terraform/checks/resource/aws/test_DeprecatedLambdaRuntime.py @@ -24,6 +24,7 @@ def test(self): failing_resources = { "aws_lambda_function.fail", "aws_lambda_function.fail2", + "aws_lambda_function.fail3", } skipped_resources = {}