# Ensure Lambda Inside a VPC Check

- Source: https://support.icompaas.com/support/solutions/articles/62000218488-ensure-lambda-inside-a-vpc-check
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

AWS Lambda is a public service that runs within a region and so that it cannot connect by default to your private Virtual Private Cloud (VPC) but you can configure a function to private subnets in a VPC in your account and you would do that so that your function can access those private resources during executions.

Lambda inside a VPC it means you allow the functions to connect to the private subnet.

  

## **Rationale:**

When the Lambda function connects with your VPC, it creates an elastic network interface in your VPC and then does a cross-account attachment. These network interfaces allow network access from your Lambda function to your private resources. These Lambda functions run inside the VPC and can only access resources over the network through your VPC.

  

## **Impact:**

 When you configure the Lambda function in a VPC it set up an Elastic Network Interface ( ENI ) using an available IP address from your private subnet, and it helps your function to connect securely to other resources available within your private VPC.

  

## **Default Value:** 

By default,  when your Lambda function is not configured to connect to your own VPCs, the function can access anything available on the public internet such as other AWS services, HTTPS endpoints for APIs, or services and endpoints outside AWS. 

By default, Lambda runs your functions in a secure VPC with access to AWS services and the internet. Lambda owns this VPC, which isn’t connected to your account’s default VPC. When you connect a function to a VPC in your account, the function can’t access the internet unless your VPC provides access.

  

#### **Pre-Requisite:**

-   For this configuration, you must connect to a private subnet with a NAT Gateway for Internet access (no public IP)
    
-   Cannot connect to a dedicated tenancy VPC.
    
-   You connect with VPC only need otherwise do not connect with VPC because Function Execution can be slow down.
    
-   Lambda uses your function’s permissions to create and manage network interfaces. To connect to a VPC, your function’s execution role must have the following permissions:
    

→ ec2: CreateNetworkInterface

→ ec2: DescribeNetworkInterfaces

→ ec2: DeleteNetworkInterfaces

-   Attach the AWSLambdaVPCAccessExecutionRole policy in your function role permission
    

![](https://support.icompaas.com/assets/kb/04fa8e39d1a661ac.png)

  

**Remediation:**

  

## **Test Plan:**

**Step 1:**  Sign in to AWS Management Console and go to Lambda dashboard at [https://console.aws.amazon.com/lambda/](https://console.aws.amazon.com/lambda/ "https://console.aws.amazon.com/lambda/").

**Step 2:**  Click on Functions in the left navigation pane and choose the function to audit

**Step 3:** In the function, you click on the Configuration tab below the Function

**Step 4:** Click on VPC to check Lambda function inside VPC![](https://support.icompaas.com/assets/kb/b1efd423a53ead0d.png)

Here this function shows VPC is not configured and it is not connected to VPC

  

#### **Using AWS CLI:**

To retrieve a list of Lambda function

aws lambda list-functions

  

To  retrieve information about a function

aws lambda get-function --function-name <give the function name>

  

if your function is not configure VPC then it gives below output

"VpcConfig": {
                "SubnetIds": \[\],
                "VpcId": "",
                "SecurityGroupIds": \[\]
}

  

### **Implementation Steps:**

**Step 1:**  Sign in to AWS Management Console and go to Lambda dashboard at [https://console.aws.amazon.com/lambda/](https://console.aws.amazon.com/lambda/ "https://console.aws.amazon.com/lambda/").

**Step 2:**  Click on Functions in the left navigation pane and choose the function to audit![](https://support.icompaas.com/assets/kb/7cbfd9e29a7bd94c.png)

**Step 3:** In the function, you click on the Configuration tab below the Function![](https://support.icompaas.com/assets/kb/c50aa99edab88f64.png)

**Step 4:** Click on VPC to  configure it![](https://support.icompaas.com/assets/kb/a244191d21f7d0d5.png)

**Step 5:** Click on the Edit button![](https://support.icompaas.com/assets/kb/ff6c62f43f6555be.png)

**Step 6:** Choose a VPC for your function to access![](https://support.icompaas.com/assets/kb/84e6765c01d435b9.png)

**Step 7:** Choose VPC Subnets for Lambda to use to set up your VPC configuration.![](https://support.icompaas.com/assets/kb/87c7a2f5f3a72001.png)

select security groups ![](https://support.icompaas.com/assets/kb/760c4c5d1c2dbf1f.png) 

**Step 8:** Click on the Save button

  

#### **Using AWS CLI**

To connect an existing function to a VPC

aws lambda update-function-configuration \\
--function-name my-function \\
--vpc-config SubnetIds=subnet-071f712345678e7c8,\\
subnet-07fd123456788a036,SecurityGroupIds=sg-085912345678492fb

  

## **Backout Plan:**

**Step 1:**  Sign in to AWS Management Console and go to Lambda dashboard at [https://console.aws.amazon.com/lambda/](https://console.aws.amazon.com/lambda/ "https://console.aws.amazon.com/lambda/").

**Step 2:**  Click on Functions in the left navigation pane and choose the function to audit

**Step 3:** In the function, you click on the Configuration tab below the Function

**Step 4:** Click on VPC to  configure it

**Step 5:** Click on the Edit button and select None and click on the Save button![](https://support.icompaas.com/assets/kb/d7b50101aeee89bd.png)

  

#### Using AWS CLI

To disconnect your function from a VPC, update the function configuration with an empty list of subnets and security groups

aws lambda update-function-configuration \\
--function-name my-function \\
--vpc-config SubnetIds=\[\],SecurityGroupIds=\[\]

  

## **Reference:**

1.  [![](https://support.icompaas.com/assets/kb/b627bd6b47e9b372.png)](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html)[Configuring a Lambda function to access resources in a VPC - AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html) 
    
2.  [https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/](https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/ "https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.