AWS Lambda Should Have DLQ Configured
More Info:
You should configure a dead letter queue (DLQ) on AWS Lambda to give you more control over message handling for all asynchronous invocations.Risk Level
InformationalAddress
SecurityCompliance Standards
HIPAA, SOC2, PCIDSS, NISTTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “AWS Lambda Should Have DLQ Configured” in AWS using AWS console, follow the steps below:
- Open the AWS Management Console and navigate to the AWS Lambda service.
- Select the Lambda function that needs to be remediated.
- In the Configuration tab, scroll down to the “Dead letter queue” section and click on “Edit”.
- In the “Dead letter queue” section, select “Enable” and then select an existing SNS topic or create a new one.
- Set the maximum number of times the function can retry failed executions. This is the number of times that AWS Lambda attempts to run your function before sending the event to the dead letter queue.
- Click on “Save” to save the configuration.
- Verify that the Dead Letter Queue is configured properly by testing the Lambda function with a sample event.
Using CLI
Using CLI
Step by step instructions on how to remediate AWS Lambda Should Have DLQ Configured using AWS CLI are:
- Open the AWS CLI on your local machine.
-
Run the following command to list all the Lambda functions in your AWS account:
- Identify the Lambda function that needs to be remediated and note down its name.
-
Run the following command to update the Lambda function and add a Dead Letter Queue (DLQ) configuration:
Replace
<function-name>with the name of the Lambda function that needs to be remediated and<arn-of-the-SQS-queue>with the ARN of the SQS queue that should be used as the DLQ for this function. -
Verify that the DLQ configuration has been added to the Lambda function by running the following command:
Replace
<function-name>with the name of the Lambda function that was remediated. -
Ensure that the SQS queue has the necessary permissions to invoke the Lambda function by adding the following policy to the SQS queue:
Replace
<arn-of-the-SQS-queue>with the ARN of the SQS queue and<arn-of-the-Lambda-function>with the ARN of the Lambda function that was remediated. -
Verify that the SQS queue has the necessary permissions to invoke the Lambda function by running the following command:
Replace
<function-name>with the name of the Lambda function that was remediated.
Using Python
Using Python
To remediate the AWS Lambda misconfiguration of not having a Dead Letter Queue (DLQ) configured, you can follow these steps using Python:In this example, we’re using the
- Open the AWS Lambda function in the AWS Management Console.
- Click on the “Configuration” tab.
- Scroll down to the “Dead Letter Queue” section and click on “Edit”.
- Select the option “Enable Dead Letter Queue” and choose an existing SQS queue or create a new one.
- Set the “Maximum Receives” value to the desired number of times a message can be unsuccessfully processed before being sent to the DLQ.
- Click on “Save” to apply the changes.
update_function_configuration method to set the DLQ configuration for a Lambda function. The DeadLetterConfig parameter takes a dictionary with the TargetArn and MaxTriggers values. The TargetArn is the ARN of the SQS queue to use as the DLQ, and MaxTriggers is the maximum number of times a message can be unsuccessfully processed before being sent to the DLQ.