Rule: Lambda functions should be in a VPC

Rule Description

Troubleshooting Steps

2. 1.
   Error: Lambda function cannot access required resources: Verify that the Lambda function is assigned to a VPC that has appropriate routing and security group configurations for the required resource access.
4. 2.
   Error: Lack of internet connectivity for Lambda function: Ensure that the VPC configuration includes appropriate NAT (Network Address Translation) settings to enable outbound internet connectivity for Lambda functions if needed.
6. 3.
   Error: Execution timeout or cold start issue: If you experience extended execution times or frequent cold starts, check if the VPC configuration is causing latency or resource limitations for Lambda function invocation.

Necessary Codes

CloudFormation

Resources:
  MyLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      ...
      VpcConfig:
        SecurityGroupIds:
          - sg-xxxxxxxx
        SubnetIds:
          - subnet-xxxxxxxx

AWS CLI

aws lambda update-function-configuration --function-name MyLambdaFunction --vpc-config "SecurityGroupIds=['sg-xxxxxxxx'],SubnetIds=['subnet-xxxxxxxx']"

Step-by-Step Guide for Remediation

2. 1.

   Identify VPC and Subnets: Determine the VPC and subnet(s) within which you want to deploy your Lambda function. Ensure that these subnets have appropriate routing configurations and are connected to the necessary resources (such as databases or other services).

4. 2.

   Identify Security Group: Identify the security group that should be associated with your Lambda function. This security group controls inbound and outbound traffic for the function.

6. 3.

   CloudFormation:

   • If you are using CloudFormation, include the

     VpcConfig

     property under the

     Properties

     section of your Lambda function resource definition. Provide the appropriate

     SecurityGroupIds

     and

     SubnetIds

     values within this property.
   • Apply the CloudFormation template to update your Lambda function with the VPC configuration.
8. 4.

   AWS CLI:

   • If you prefer using the AWS CLI, execute the following command to update the Lambda function's configuration:

     aws lambda update-function-configuration --function-name MyLambdaFunction --vpc-config "SecurityGroupIds=['YourSecurityGroupId'],SubnetIds=['YourSubnetId']"
     

   Replace

   MyLambdaFunction

   ,

   YourSecurityGroupId

   , and

   YourSubnetId

   with your actual function name, security group ID, and subnet ID respectively.

10. 5.

    Verify Function Execution: After updating the Lambda function's configuration to use the VPC, redeploy it if necessary. Confirm that the function executes as expected, while now being within the defined VPC boundaries.