Lambda function is deployed inside a VPC

awslambda_function_inside_vpc

Service: awslambdaSeverity: low

OfficialBuilt-inVerified

Categories:trust-boundaries

Resource Type:AwsLambdaFunction

AWS Lambda function uses VPC networking with specified subnets and security groups, rather than the default Lambda-managed network.

Presence of a VPC association (vpc_id) indicates private connectivity to VPC resources.

Prowler prowler-provider-aws

Risk

Without VPC attachment, functions lack network isolation and granular egress control, weakening confidentiality and integrity.

Traffic must use public endpoints, raising risks of data exfiltration and SSRF via unrestricted outbound. If private databases are required, missing VPC access can impact availability.

Run this check with Prowler

Run in Prowler Cloud

Run

prowler aws --checks awslambda_function_inside_vpc

Recommendation

Attach functions to a VPC with private subnets and restrictive security groups to enforce least privilege and egress control.

Prefer VPC endpoints for AWS services
Use NAT only when necessary
Spread subnets across AZs for resilience
Govern with IAM conditions requiring VpcIds, SubnetIds, and SecurityGroupIds.

Remediation

CLI

aws lambda update-function-configuration --function-name <example_resource_name> --vpc-config SubnetIds=<example_subnet_id>,SecurityGroupIds=<example_security_group_id>

Terraform

resource "aws_lambda_function" "example" {
  function_name = "<example_resource_name>"
  role          = "<example_role_arn>"
  handler       = "index.handler"
  runtime       = "python3.12"
  filename      = "<example_package.zip>"

  # Critical: VPC config attaches the function to a VPC, providing a VPC ID so the check passes
  vpc_config {
    subnet_ids         = ["<example_subnet_id>"]      # at least one subnet
    security_group_ids = ["<example_security_group_id>"]
  }
}

NativeIaC

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: <example_resource_name>
      Role: <example_role_arn>
      Handler: index.handler
      Runtime: python3.12
      Code:
        S3Bucket: <example_code_bucket>
        S3Key: <example_code_key>
      # Critical: Attach the function to a VPC by specifying at least one subnet and one security group
      # This sets VpcConfig, which gives the function a VPC ID and makes the check PASS
      VpcConfig:
        SubnetIds:
          - <example_subnet_id>
        SecurityGroupIds:
          - <example_security_group_id>

Other

1In the AWS Lambda console, open your function

2Go to Configuration > VPC and click Edit

3Select the target VPC

4Choose at least one Subnet and one Security group

5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.awslambda.awslambda_client import awslambda_client


class awslambda_function_inside_vpc(Check):
    def execute(self) -> List[Check_Report_AWS]:
        findings = []
        for function_arn, function in awslambda_client.functions.items():
            report = Check_Report_AWS(metadata=self.metadata(), resource=function)

            report.status = "PASS"
            report.status_extended = (
                f"Lambda function {function.name} is inside of VPC {function.vpc_id}"
            )

            if not function.vpc_id:
                awslambda_client.set_failed_check(
                    self.__class__.__name__,
                    function_arn,
                )
                report.status = "FAIL"
                report.status_extended = (
                    f"Lambda function {function.name} is not inside a VPC"
                )

            findings.append(report)

        return findings