Lambda Delete Unused Provisioned Capacity

AWS Resource Type:
AWS Lambda

Opportunity Description:

This Finder detects AWS Lambda functions with provisioned concurrency configured but no invocation activity over a specified period (default: 30 days). Provisioned concurrency is a powerful feature for minimizing cold starts, but it incurs continuous charges—whether your function is invoked or not.

Many organizations leave provisioned concurrency enabled on test, deprecated, or migrated functions, unknowingly racking up unnecessary costs. This Finder helps eliminate that waste by surfacing unused provisioned capacity for cleanup.

Criteria for identifying the opportunity:

• The Lambda function exists and is in an ACTIVE state.

• Provisioned concurrency is configured on a specific function alias or version.

• The function has had zero (or minimal) invocations during the lookback period (default: 30 days).

• The total cost of the provisioned concurrency is greater than zero.

• The function is not tagged with cloudfix:dontFixIt.

Potential Savings (Annual Estimate):

Provisioned concurrency is billed per GB-second, per hour. Deleting unused configurations can recover 100% of associated provisioned capacity costs, which may range from a few dollars to thousands annually—especially for high-memory functions or those with multiple concurrent units.

The Finder uses annualized cost data from the AWS Cost and Usage Report (CUR) to estimate savings per function.

What happens when the Fixer is executed?

This Finder has an automatic Fixer. Once you generate the runbook and execute it (see below), CloudFix runs an AWS Systems Manager Automation runbook that performs the following steps, in order:

1. Delete the provisioned concurrency configuration — calls lambda:DeleteProvisionedConcurrencyConfig for the specific function alias or version identified by the Finder as unused.
2. Wait briefly for the deletion to take effect.
3. Tag the underlying function — calls lambda:TagResource on the function's base ARN (without the alias/version qualifier) to record cloudfix:fixerId, cloudfix:originalResourceId, and cloudfix:executionDate for traceability.

As with other CloudFix fixers, this runs as an SSM Automation execution: from the finder's dashboard row you generate the runbook, then select the resource on the Available to Execute tab and click Execute. It does not run on its own unless Always Execute Fixer is enabled for this Finder in Settings → Finders & Fixers.

Is it possible to roll back once CloudFix implements the Fixer?

Not automatically — there is no rollback runbook for this Fixer. If you need to restore provisioned concurrency after the fix runs, you'll need to reconfigure it manually, either from the AWS Console or via the Lambda PutProvisionedConcurrencyConfig API, using the concurrency count, alias/version, and function name recorded in the original recommendation report.

Can CloudFix implement the fix automatically once I accept the recommendation?

Yes. Once you approve the recommendation and execute it, CloudFix runs the automation above to delete the unused provisioned concurrency configuration — no manual change in the AWS Console or Lambda API is required. Turning on Always Execute Fixer for this Finder lets CloudFix apply the fix automatically as soon as it's found, without a manual click.

Does the fix require downtime?

No. Removing provisioned concurrency does not affect availability but may increase cold start latency if the function is invoked again in the future.

Additional Resources:

• AWS Lambda Provisioned Concurrency

• AWS Lambda Pricing

• CloudWatch Metrics for Lambda