Exceeds versions limits remediation

aws lambda list-functions --query 'Functions[].{FunctionName:FunctionName, Version:Version}' --output table

FUNC_NAME="my-function"

aws lambda list-versions-by-function \
  --function-name "$FUNC_NAME" \
  --query 'length(Versions[])'

FUNC_NAME="my-function"

aws lambda list-versions-by-function \
  --function-name "$FUNC_NAME" \
  --output table \
  --query 'Versions[].{Version:Version, LastModified:LastModified, Description:Description}'

FUNC_NAME="my-function"

aws lambda list-aliases \
  --function-name "$FUNC_NAME" \
  --query 'Aliases[].{Name:Name, FunctionVersion:FunctionVersion}' \
  --output table

FUNC_NAME="my-function"
VER_TO_DELETE="5"

aws lambda delete-function \
  --function-name "$FUNC_NAME" \
  --qualifier "$VER_TO_DELETE"

FUNC_NAME="my-function"
KEEP_RECENT=10

# Versions used by aliases
ALIAS_VERSIONS=$(aws lambda list-aliases \
  --function-name "$FUNC_NAME" \
  --query 'Aliases[].FunctionVersion' \
  --output text)

# All numbered versions, sorted newest first, excluding $LATEST
ALL_VERSIONS=$(aws lambda list-versions-by-function \
  --function-name "$FUNC_NAME" \
  --query "Versions[?Version!='\$LATEST'].Version" \
  --output text | tr '\t' '\n' | sort -nr)

# Build list of versions to keep
KEEP_SET=$(printf "%s\n" $ALL_VERSIONS | head -n $KEEP_RECENT; printf "%s\n" $ALIAS_VERSIONS) \
  | sort -n | uniq

# Delete everything not in KEEP_SET
for v in $ALL_VERSIONS; do
  if ! printf "%s\n" $KEEP_SET | grep -qx "$v"; then
    echo "Deleting $FUNC_NAME version $v"
    aws lambda delete-function --function-name "$FUNC_NAME" --qualifier "$v"
  fi
done

for FUNC_NAME in $(aws lambda list-functions --query 'Functions[].FunctionName' --output text); do
  echo "Processing $FUNC_NAME"
  # Insert the version‑cleanup logic from step 5 here, referencing $FUNC_NAME
done

aws lambda list-versions-by-function --function-name "my-function" --query 'length(Versions[])'

{
  "Effect": "Allow",
  "Action": [
    "lambda:ListVersionsByFunction",
    "lambda:ListAliases",
    "lambda:DeleteFunction"
  ],
  "Resource": "arn:aws:lambda:REGION:ACCOUNT_ID:function:FUNCTION_NAME"
}

pip install boto3

import boto3

# -------- CONFIGURE THESE --------
REGION = "us-east-1"
FUNCTION_NAME = "my-lambda-function"  # name or full ARN
VERSIONS_TO_KEEP = 10  # number of most recent versions to retain (besides aliased)
# ---------------------------------

lambda_client = boto3.client("lambda", region_name=REGION)


def get_all_versions(function_name):
    versions = []
    paginator = lambda_client.get_paginator("list_versions_by_function")
    for page in paginator.paginate(FunctionName=function_name):
        versions.extend(page.get("Versions", []))
    # Exclude $LATEST from deletion logic
    return [v for v in versions if v["Version"] != "$LATEST"]


def get_aliased_versions(function_name):
    aliased_versions = set()
    paginator = lambda_client.get_paginator("list_aliases")
    for page in paginator.paginate(FunctionName=function_name):
        for alias in page.get("Aliases", []):
            aliased_versions.add(alias["FunctionVersion"])
    return aliased_versions


def delete_version(function_name, version):
    print(f"Deleting version {version} of {function_name}")
    lambda_client.delete_function(
        FunctionName=function_name,
        Qualifier=version
    )


def main():
    # 1. Get all versions (excluding $LATEST)
    all_versions = get_all_versions(FUNCTION_NAME)

    # Sort by numeric version (string to int)
    all_versions_sorted = sorted(
        all_versions,
        key=lambda v: int(v["Version"])
    )

    # 2. Find versions referenced by aliases
    aliased_versions = get_aliased_versions(FUNCTION_NAME)
    print(f"Aliased versions: {aliased_versions}")

    # 3. Determine versions to always keep
    #    a) aliased versions
    #    b) latest N versions
    latest_versions = all_versions_sorted[-VERSIONS_TO_KEEP:]
    latest_versions_set = {v["Version"] for v in latest_versions}

    protected_versions = aliased_versions.union(latest_versions_set)

    print(f"Latest {VERSIONS_TO_KEEP} versions: {latest_versions_set}")
    print(f"Protected versions (aliased + latest): {protected_versions}")

    # 4. Identify deletable versions
    deletable_versions = [
        v["Version"]
        for v in all_versions_sorted
        if v["Version"] not in protected_versions
    ]

    if not deletable_versions:
        print("No versions to delete based on current policy.")
        return

    print("Versions to delete:", deletable_versions)

    # 5. Delete (uncomment actual delete when ready)
    for version in deletable_versions:
        # Safety: final check that version is not protected
        if version in protected_versions:
            continue
        delete_version(FUNCTION_NAME, version)


if __name__ == "__main__":
    main()

def list_all_functions():
    funcs = []
    paginator = lambda_client.get_paginator("list_functions")
    for page in paginator.paginate():
        funcs.extend(page["Functions"])
    return funcs

def main():
    functions = list_all_functions()
    for f in functions:
        name = f["FunctionName"]
        print(f"\nProcessing function: {name}")
        # reuse logic above, parameterize FUNCTION_NAME with name

# Terraform cannot automatically prune existing AWS Lambda versions.
# Version cleanup must be done via CLI/console or an external process.

# Going forward, ensure Terraform does NOT keep creating new versions
# unless you explicitly need them.

resource "aws_lambda_function" "this" {
  function_name = "LAMBDA_FUNCTION_NAME"   # substitute your Lambda name
  role          = aws_iam_role.lambda_exec.arn
  handler       = "HANDLER_NAME"          # e.g. "index.handler"
  runtime       = "RUNTIME_NAME"          # e.g. "python3.11"
  filename      = "PACKAGE_ZIP_PATH"      # e.g. "build/lambda.zip"

  # Do NOT set publish = true unless you want a new version every apply
  # publish = true

  # ...other required arguments...
}