Pick Auto for most functions, because Lambda applies runtime security updates for you. Pick Function update if you want patches to arrive only with your own deployments. Use Manual only as a short term rollback, since the function keeps that runtime version indefinitely and stops receiving updates.
What each mode does
AWS lets you choose a runtime update mode for each function version:
| Mode | When the runtime updates | Your duty |
|---|---|---|
| Auto (default) | Lambda updates it automatically using a two phase rollout | Update your own code and dependencies |
| Function update | When you update the function | Deploy often enough to stay current |
| Manual | Never, until you change the setting | Remember to move off the pinned version |
The two phase rollout
In phase one, Lambda applies the new runtime version when you create or update a function. In phase two, it updates functions in Auto mode that have not been updated yet. If you deploy regularly, you usually pick up new runtime versions in phase one. Functions that sit untouched still get the update in phase two, which is the real benefit of Auto.
How to choose
Ask three questions.
- Do I deploy this function often? If yes, Function update is workable, because patches arrive with a deploy you are already watching. If it is rarely touched, Function update means it may go months on an old runtime version.
- Would an unexpected change hurt? AWS notes that rare incompatibilities can occur, for example when a patch exposes a bug that relied on insecure behavior. Health critical functions may prefer Function update plus tests.
- Do I have tests that run before deploy? Without them, Function update only moves the surprise to a deploy day.
The trap with Manual
AWS describes Manual as a way to roll back to an earlier runtime version if a new one breaks your function. It also says to avoid using Manual to try to achieve runtime consistency across deployments. A pinned runtime version is a pinned set of unpatched issues. If you must use it, set a calendar reminder and a ticket to return to Auto.
For consistency across regions, AWS points to container images: runtime versions roll out gradually across regions, so functions deployed at different times can pick up different versions.
Cut compatibility risk instead of avoiding patches
AWS recommends packaging all dependencies, including the SDK, so a runtime update does not change the libraries your code depends on. It also says not to deploy custom operating system libraries that could conflict with future updates.
Quick check
Does Manual mode protect me from bad patches?
It protects you from runtime changes, good and bad. The function stays on the chosen runtime version indefinitely, so it also misses security fixes.
Are runtime update modes per function or per version?
AWS documents them per function version, including $LATEST and published versions.
Safeguard's policies and gates can enforce checks on pull requests before a deployment, and its dependency scanning covers the libraries in your function. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
