Lambda Function Dead-Letter Queue Configuration Rule
This rule focuses on configuring Lambda functions with a dead-letter queue for enhanced operational efficiency.
| Rule | Lambda functions should be configured with a dead-letter queue |
| Framework | SOC 2 |
| Severity | ✔ Medium |
Rule Description:
This rule requires that Lambda functions should be configured with a dead-letter queue as per the SOC 2 compliance standard. A dead-letter queue is a storage queue that receives messages from other queues when they cannot be delivered to the intended destination. It helps to capture and store failed Lambda function invocations, allowing for better monitoring and troubleshooting.
Troubleshooting Steps:
- 1.
Verify if the Lambda function has been configured with a dead-letter queue.
- 2.
Check if the dead-letter queue is properly configured and accessible by the Lambda function.
- 3.
Ensure that the permissions are set correctly to allow the Lambda function to send messages to the dead-letter queue.
Necessary Codes:
To configure a dead-letter queue for a Lambda function, use the following code snippet:
aws lambda update-function-configuration --function-name <function-name> --dead-letter-config TargetArn=<dead-letter-queue-arn>Replace
<function-name><dead-letter-queue-arn>Step-by-Step Guide for Remediation:
- 1.
Identify the Lambda function that needs to be configured with a dead-letter queue.
- 2.
Open the AWS Management Console and navigate to the AWS Lambda service.
- 3.
In the Lambda console, search for the desired Lambda function by name or other relevant filters.
- 4.
Select the Lambda function to open its configuration details.
- 5.
Scroll down to the "Dead letter queue" section in the configuration page.
- 6.
Click on the "Configure" button to configure the dead-letter queue.
- 7.
In the "Configure dead-letter queue" pop-up window, select the desired dead-letter queue from the drop-down menu or create a new dead-letter queue if required.
- 8.
Once the dead-letter queue is selected, click on the "Save" button to save the configuration.
- 9.
Verify if the dead-letter queue configuration is reflected in the Lambda function's details page.
- 10.
Test the Lambda function to ensure that failed invocations are captured and sent to the dead-letter queue for further analysis.
Following these steps will ensure that the Lambda function is configured with a dead-letter queue, meeting the requirements of the SOC 2 compliance standard.