bug: AwsSolutions-L1 flags Python 3.11 runtime as not the latest

[hearde]

What is the problem?

AwsSolutions-L1 flags Python 3.11 runtime as not the latest. 3.11 is the latest supported runtime.

Reproduction Steps

Create a Lambda function with the Python 3.11 runtime, synth.

What did you expect to happen?

Success.

What actually happened?

[Error at <path>] AwsSolutions-L1: The non-container Lambda function is not configured to use the latest runtime version. Use the latest available runtime for the targeted language to avoid technical debt. Runtimes specific to a language or framework version are deprecated when the version reaches end of life. This rule only applies to non-container Lambda functions.

cdk-nag version

2.27.173

Language

Typescript

Other information

No response

[dontirun]

What version of the CDK are you using? Can you post a snippet of code to reproduce the issue?

[hearde]

CDK version 2.114.1. Looks like I'm not the only one who was run into this.

new PythonFunction(this, "id", {
  entry: "app",
  runtime: Runtime.PYTHON_3_11,
});

[dontirun]

Related to this issue aws/aws-cdk#26451 . It looks like the CDK released the Python 3.12 runtime early. cdk-nag sources runtimes from the CDK so it looks like 3.11 isn't the latest version

[clueleaf]

It looks like Python 3.12 is released now.
https://aws.amazon.com/blogs/compute/python-3-12-runtime-now-available-in-aws-lambda/

[mrgrain]

@dontirun Do you have plans to replace this rule with one that instead checks that no deprecated runtime is used?

[dontirun]

@mrgrain I would like to add a prebuilt rule for deprecated runtimes. My personal opinion is that a deprecated runtimes rule would be more useful, however, that rule would not replace AwsSolutions-L1 unless the guidance for AWS Solutions changes.