Remediating Trusted Advisor Lambda Deprecated Runtime Findings with AWS Transform custom

Overview

AWS Lambda periodically deprecates runtimes as upstream language communities end long-term support. Functions running deprecated runtimes lose access to security patches and technical support, potentially exposing applications to known vulnerabilities and compliance risks. In some cases, they also incur Extended Support charges.

AWS Transform custom addresses this by automating language-version upgrades using AI. It analyzes your code, updates syntax, adjusts dependencies, and validates the result without requiring specialized automation expertise.

---

Step 1: Identify affected Lambda functions

Start by locating the affected functions in Trusted Advisor.

1. Open the AWS Console and navigate to Trusted Advisor → Recommendations (or Priority if your account is enrolled in Priority).
2. Locate the check: "AWS Lambda functions using deprecated runtimes."
3. Review the finding details. Each affected function lists:
   • Function name and ARN
   • Current runtime (e.g., Python 3.8, Node.js 16)
   • Region
4. Export the list for planning:
   • Console: Download CSV from the check detail page.
   • CLI: Use the Support API to pull findings programmatically:

     aws support describe-trusted-advisor-check-result --check-id <check-id>

5. Prioritize by urgency:
   • Runtimes already past end-of-support (e.g., Python 3.8, Node.js 14) require immediate action.
   • Runtimes approaching end-of-support (e.g., Python 3.9, Node.js 18) should be planned within 30 days.

For organizations using AWS Organizations, the Trusted Advisor organizational view aggregates findings across all member accounts into a single report.

---

Step 2: Prepare your environment

Before running transformations, set up the AWS Transform CLI and plan your approach.

Install prerequisites:

1. Install the AWS Transform CLI:

   pip install atx

   For detailed setup, see the Getting Started guide.

2. Configure AWS credentials with permissions to invoke AWS Transform.

3. Install Git for repository operations.

Plan the upgrade:

4. Map your Trusted Advisor findings to source code repositories. Identify which repo contains each affected function.

5. Select the correct AWS-managed transformation:

   Current Runtime	Target	Transformation Name
   Python 3.8 / 3.9	Python 3.13	AWS/python-version-upgrade
   Node.js 16 / 18	Node.js 22	AWS/nodejs-version-upgrade
   Java 8 / 11	Java 21	AWS/java-version-upgrade
   .NET 6	.NET 8	AWS/dotnet-version-upgrade

6. Choose your execution mode based on scale:

   • Interactive — Best for initial validation of a single function.
   • Non-interactive — Suitable for batch upgrades across multiple repos via scripting.
   • Containerized — Required for enterprise-scale rollouts of 1,000+ functions (see Step 4).

---

Step 3: Execute the upgrade

With your environment ready, run the transformation. Start with a single function to validate the process, then scale up.

Interactive mode (single function):

Navigate to your function's source repository and launch the CLI:

cd my-lambda-repo
atx -t

In the interactive session, describe the upgrade using natural language:

> Upgrade this Python 3.9 Lambda function to Python 3.13

The agent analyzes your code and selects the appropriate transformation. It updates language syntax, adjusts dependencies, and modernizes deprecated API calls. If you provide a validation command (e.g., pytest), the agent runs your test suite automatically to verify the upgrade.

Non-interactive mode (multiple functions):

Once you've validated the process interactively, switch to non-interactive mode for batch execution:

atx custom def exec \
  -n AWS/python-version-upgrade \
  -p ./my-lambda-repo \
  -c "python -m pytest tests/" \
  -g "additionalPlanContext='Upgrade from Python 3.9 to Python 3.13'" \
  -x -t

The key flags:

• -n — Transformation name
• -p — Path to repository
• -c — Validation command (your test suite)
• -g — Additional context for the AI agent
• -x — Non-interactive mode (no prompts)
• -t — Trust all tool executions

Scripting across multiple repositories:

To process several repositories in sequence, wrap the command in a loop: `

for repo in lambda-auth lambda-orders lambda-notifications; do
  atx custom def exec \
    -n AWS/python-version-upgrade \
    -p ./$repo \
    -c "python -m pytest tests/" \
    -g "additionalPlanContext='Upgrade from Python 3.9 to Python 3.13'" \
    -x -t
done

After each transformation completes, review the Git diff and run your full test suite before deploying.

---

Step 4: Scaling to thousands of functions

For organizations managing 1,000+ Lambda functions across multiple AWS accounts, the bash loop approach becomes impractical. AWS Transform custom offers two enterprise-scale execution models designed for this scenario.

Option A: Batch script execution

This approach works well for teams that prefer running transformations on developer machines, EC2 instances, or existing CI/CD infrastructure. It wraps the CLI in a batch processing script that reads from a CSV or JSON input file.

Key capabilities:

• Serial and parallel execution with configurable job limits
• Built-in retry mechanisms for transient failures
• Comprehensive logging per repository

Get started with the sample batch launcher: aws-transform-custom-samples/scaled-execution-bash

Option B: Containerized execution on AWS Batch + Fargate

For fleets exceeding 1,000 functions, the containerized approach provides managed infrastructure and centralized monitoring. Transformations run in containers orchestrated by AWS Batch with Fargate compute — no servers to manage.

This solution includes:

• A REST API for programmatic job submission
• Automatic IAM credential management
• Full CloudWatch monitoring for progress tracking
• Single-command CDK deployment

Get started with the containerized solution: aws-transform-custom-samples/scaled-execution-containers

For a detailed walkthrough, see: Building a scalable code modernization solution with AWS Transform custom

Campaign management

The AWS Transform web application enables central platform teams to manage organization-wide rollouts. You can define campaigns (e.g., "Upgrade all Python 3.8 functions to 3.13"), assign target repositories, and track completion across teams.

Recommended workflow for large fleets

1. Export TA findings across all accounts using the organizational view.
2. Build a mapping file that links each function ARN to its source repository, current runtime, and target version.
3. Group functions by runtime type (Python, Node.js, Java) and repository structure.
4. Deploy the containerized execution solution via CDK.
5. Submit transformation jobs via REST API, grouped by runtime.
6. Monitor progress in CloudWatch and handle failures with retries.
7. Review and merge the pull requests generated by Transform.
8. Deploy through your existing CI/CD pipelines.
9. Re-check Trusted Advisor to confirm findings are resolved.

Important considerations:

• AWS Transform modifies source code in your repositories — not live Lambda functions. You still deploy through your normal CI/CD pipeline.
• Cross-account AWS access is not needed for Transform itself. It runs against your code repos, not your AWS accounts.
• The most time-consuming step is often mapping function ARNs to source repositories. Invest time upfront in building this mapping.
• Start with a pilot batch of 10–20 functions to validate transformation quality before scaling to the full fleet.

---

Verify and close the loop

After deploying your upgraded functions, confirm the remediation is complete.

1. Check Trusted Advisor. The deprecated runtime findings should clear within 24 hours of deployment.
2. Set up proactive monitoring. Create an EventBridge rule on Trusted Advisor check status changes to alert you when new deprecated runtimes appear.
3. Integrate into CI/CD. Consider adding AWS Transform to your pipeline to catch deprecated runtimes before they reach end-of-support.

---

References

AWS Transform custom:

• Common Use Cases — Lambda Runtime Upgrades
• Getting Started with AWS Transform custom
• Scaled execution samples (GitHub)

Blog posts:

• Automate AWS Lambda Runtime Upgrades with AWS Transform custom (March 2026)
• Building a scalable code modernization solution with AWS Transform custom
• AWS Transform Custom: Automating .NET Lambda Runtime Upgrades (May 2026)

Lambda runtime lifecycle:

• Lambda Runtime Deprecation Schedule

Trusted Advisor:

• Trusted Advisor organizational view
• EventBridge integration with Trusted Advisor