Lambda Variable Runtime

What this rule checks

Detects Lambda functions using a variable runtime (Runtime.NODEJS_LATEST or useLatestRuntimeVersion) that resolves to the newest runtime at synth time, causing silent in-place runtime upgrades on the next deploy after a CDK bump.

How to fix it

1. 1Pin an explicit runtime (e.g. Runtime.NODEJS_22_X)
2. 2Or set useLatestRuntimeVersion: false on NodejsFunction
3. 3Treat runtime upgrades as a deliberate, reviewed change

import * as lambda from 'aws-cdk-lib/aws-lambda';

// Variable runtime: resolves to whatever the newest Node.js runtime is at
// synth time, so a CDK upgrade silently changes the deployed runtime.
new lambda.Function(this, 'Fn', {
  runtime: lambda.Runtime.NODEJS_LATEST,
  handler: 'index.handler',
  code: lambda.Code.fromInline('exports.handler = async () => {};'),
});

import * as lambda from 'aws-cdk-lib/aws-lambda';

// Explicitly pinned runtime — upgrades are a deliberate, reviewed change.
new lambda.Function(this, 'Fn', {
  runtime: lambda.Runtime.NODEJS_22_X,
  handler: 'index.handler',
  code: lambda.Code.fromInline('exports.handler = async () => {};'),
});

CDK Insights pinpoints the exact file and line in your CDK source for every finding, so you can jump straight to the fix.

Affected resource types

Intentional? Suppress this finding

Sometimes a flag is deliberate — a genuinely public endpoint, say. You can dismiss lambda-runtime-pinned-latest and the reason is kept in the report, not silently hidden.

In .cdk-insights.json:

{
  "ignoreRules": [
    { "id": "lambda-runtime-pinned-latest", "reason": "Why this is intentional" }
  ]
}

Or inline in your CDK code:

Validations.of(scope).acknowledge({
  id: 'cdk-insights::lambda-runtime-pinned-latest',
  reason: 'Why this is intentional',
});

Use the rule ID lambda-runtime-pinned-latest shown above — not the CDK-* ID from SARIF / GitHub code scanning. To dismiss every finding on one construct instead, use ignorePaths. Suppression docs →

More Lambda rules