aws-s3-deployment: BucketDeployment creates Lambda function with unsupported runtime

[jesse-small]

Describe the bug

When using the BucketDeployment a lambda will be created using an old runtime version of python. This causes the AwsSolutions-L1 to complain stating that a non-container Lambda function is not configured to use the latest runtime version.

This seems to be a repeat of this issue: #21470

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

The BucketDeployment should either let me control which runtime it uses, or default to the latest.

Current Behavior

BucketDeployment is using an old runtime and this causes CDK deployments to fail.

Reproduction Steps

aws-cdk: 2.1013.0
aws-cdk-lib: 2.194.0

Attempt to create a BucketDeployment and an error will be thrown stating:

"AwsSolutions-L1: The non-container Lambda function is not configured to use the latest runtime version. Use the latest available runtime for the targeted language to avoid technical debt. Runtimes specific to a language or framework version are deprecated when the version reaches end of life. This rule only applies to non-container Lambda functions."

Possible Solution

Let me control the runtime, or update the runtime to use the latest that the CDK cli is expecting.

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

2.194.0

AWS CDK CLI version

2.1013.0

Node.js Version

22

OS

macOS Sequoia 15.4.1

Language

TypeScript

Language Version

No response

Other information

No response

[jesse-small]

Looking through the code, previously the runtime was set but now it looks as though the runtime is not set.

    const handler = new BucketDeploymentSingletonFunction(this, 'CustomResourceHandler', {
      uuid: this.renderSingletonUuid(props.memoryLimit, props.ephemeralStorageSize, props.vpc),
      layers: [new AwsCliLayer(this, 'AwsCliLayer')],
      environment: {
        ...props.useEfs ? { MOUNT_PATH: mountPath } : undefined,
        // Override the built-in CA bundle from the AWS CLI with the Lambda-curated one
        // This is necessary to make the CLI work in ADC regions.
        AWS_CA_BUNDLE: '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem',
      },
      lambdaPurpose: 'Custom::CDKBucketDeployment',
      timeout: cdk.Duration.minutes(15),
      role: props.role,
      memorySize: props.memoryLimit,
      ephemeralStorageSize: props.ephemeralStorageSize,
      vpc: props.vpc,
      vpcSubnets: props.vpcSubnets,
      filesystem: accessPoint ? lambda.FileSystem.fromEfsAccessPoint(
        accessPoint,
        mountPath,
      ) : undefined,
      // props.logRetention is deprecated, make sure we only set it if it is actually provided
      // otherwise jsii will print warnings even for users that don't use this directly
      ...(props.logRetention ? { logRetention: props.logRetention } : {}),
      logGroup: props.logGroup,
    });

[jesse-small]

Digging in more, it looks like "bucket-deployment-provider.generated.js" found in aws-cdk-lib/aws-s3-deployment/bucket-deployment-provider.generated.js is setting the runtime to

runtime: lambda.Runtime.PYTHON_3_11

[ykethan]

Hey @jesse-small, thank you for reaching. Observed this message using the following code:

import {
  Stack,
  StackProps,
  RemovalPolicy,
  CfnOutput,
  Aspects
} from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as s3deploy from 'aws-cdk-lib/aws-s3-deployment';
import * as path from 'path';
// Import the cdk-nag module
import {
  AwsSolutionsChecks
} from 'cdk-nag';

export class S3DeploymentWarningWithNagStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // Add the AWS Solutions checks aspect to this stack
    Aspects.of(this).add(new AwsSolutionsChecks());

    // Create an S3 bucket
    const deploymentBucket = new s3.Bucket(this, 'DeploymentBucket', {
      removalPolicy: RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
    });

    // Create a simple file to deploy
    const deployment = new s3deploy.BucketDeployment(this, 'DeployWebsite', {
      sources: [s3deploy.Source.asset(path.join(__dirname, '../assets'))],
      destinationBucket: deploymentBucket,
    });

    // Output the bucket name
    new CfnOutput(this, 'BucketName', {
      value: deploymentBucket.bucketName,
      description: 'S3 Bucket for deployment',
    });
  }
}

on cdk synth observed the following message:

[Error at /S3DeploymentWarningWithNagStack/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/Resource] AwsSolutions-L1: The non-container Lambda function is not configured to use the latest runtime version.

Generated templated:

# Lambda created by BucketDeployment
CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C81C01536:
  Type: AWS::Lambda::Function
  Properties:
    # ... other properties ...
    Runtime: python3.11
    # ... other properties ...

On diving into this, from #34013 and #34036 noticed the runtime was reverted to v3.11 as this would require confirmation that all AWS regions currently does support v3.13.

as the previous issue #21470 is currently closed, will keep this issue open for tracking. Marking as P2 feature request.

[jesse-small]

@ykethan so would the recommendation be to suppress the error from cdk-nag? Thank for you for the update and reasons explained.

[ykethan]

Hey @jesse-small, at this time yes you may need to suppress this message. additionally, this issue #26451 should also encapsulate additional information with an example of nag suppression you can use.

[jesse-small]

@ykethan Appreciate the quick response, I'll add a suppression for now and add a reminder to check when this update is available. Thanks!