Ensure AWS Lambda function is configured with a Dead Letter Queue

LOW

Description

Dead letter queues on AWS Lambda can give developers more control over message handling for all asynchronous invocations, including those delivered via AWS events (S3, SNS, IoT, etc). Periodic review of Lambda Dead letter Queues can help ensure the availability of applications and functions.

Remediation

In AWS Console -

  1. Sign in to AWS Console and go to the Functions page on the Lambda console.
  2. Choose a function to update.
  3. Select Configuration and then choose Asynchronous invocation.
  4. Under Asynchronous invocation, select Edit.
  5. Set DLQ resource to Amazon SQS or Amazon SNS.
  6. Select the target queue or topic.
  7. Select Save.

In Terraform -

  1. In the aws_lambda_function resource, set the dead_letter_config.target_arn field with the appropriate value for a queue or topic.

References:
https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-dlq
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#dead_letter_config

Policy Details

Rule Reference ID: AC_AWS_0613
CSP: AWS
Remediation Available: Yes
Resource Category: Serverless
Resource Type: Lambda

Frameworks