<p>I have also asked the AWS Support folks for help too, as Lambda's security was crucial for us [HIPAA compliancy].</p>

<p>This was their response:</p>

<blockquote>
  <p>Lambda has two options, you can have your lambda functions without a
  VPC or you could place your lambda function within a VPC. If you want
  to put your lambda function within VPC, then the most important thing
  to note is lambda function must be placed in private subnet. If you
  want to access internet resources from Lambda or make any AWS SDK API
  Calls, then you need to have the internet access for which you need to
  have a NAT Gateway or NAT Instance setup for the VPC, where your
  lambda function resides and have the private subnet point to the NAT
  Gateway. When lambda functions are placed within public subnet ( with
  an IGW route), then the lambda function won't work.</p>
</blockquote>

<p>So, a lambda function can be put into a private subnet of a VPC, but not inside a public subnet. And for being able to create instances and ssh'ing into them, from this Lambda, add the private subnet to the security group of the public subnet [or another hacky way, is to add the VPC's IP range to the security group].</p>

CC BY-SA 3.0
2017-06-26T22:39:06.390Z
To be exact, each Lambda has an ENI attached to it. And these ENIs never get assigned public IPs. So it is possible to start Lambdas in a Public subnet, but these wouldn't be receiving any public IPs so will only be able to communicate with other addresses within the same VPC.

And when the AWS account reaches the max ENIs limit ... you can imagine what happens ;)
Evgeny Zislis
CC BY-SA 3.0
2017-06-29T11:59:49.367Z
@Evgeny Superbly explained [like always :D] . Thanks :)
Dawny33
CC BY-SA 3.0
2017-06-26T05:34:32.880Z
2017-06-26T05:34:32.880Z
Dawny33
<p>The API for creating a function includes a section to choose which VPC to use for running that function.</p>

<p>source: <a href="https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-CreateFunction-request-VpcConfig" rel="nofollow noreferrer">https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-CreateFunction-request-VpcConfig</a></p>

<p>It doesn't have to be the default VPC, it can be any VPC.</p>

<p>Consider that "EC2 server inside a VPC" only means that it is some virtual machine that has a NIC connected to a network you have control over in your AWS account (the VPC).</p>

<p>With Lambda, you can choose to run functions on instances that have this NIC connected to a VPC under your control, or you can forego this control and let the Lambdas run where ever they usually do (default system-managed whatever) and just not care about it.</p>

CC BY-SA 3.0
2017-06-22T11:32:05.403Z
2017-06-22T14:26:00.010Z
2017-06-22T14:26:00.010Z
Evgeny Zislis
<p>The VPC configurations option in Lambda tells this:</p>

<blockquote>
  <p>All AWS Lambda functions run securely inside a default system-managed
  VPC. However, you can optionally configure Lambda to access resources,
  such as databases, within your custom VPC.</p>
</blockquote>

<p><strong>So, can't I launch the Lambda function in my own VPC?</strong></p>

CC BY-SA 3.0
2017-06-22T09:07:53.260Z
Short answer: no, as lambda code run on machines you don't have any idea of and managed directly by AWS. If you want to run your python lambda code within your VPC, you'll have to set-up an instance with python for this :)
Tensibai
CC BY-SA 3.0
2017-06-26T05:51:47.563Z
@Tensibai Apparently, it does :D. I blame the AWS docs for being unclear :D
Dawny33
<security><aws-lambda><aws-vpc>
How do I launch Lambda in my own VPC?
Dawny33
# How do I launch Lambda in my own VPC?

(Asked by: username_0 on 2017-06-22)

The VPC configurations option in Lambda tells this:

> All AWS Lambda functions run securely inside a default system-managed
> VPC. However, you can optionally configure Lambda to access resources,
> such as databases, within your custom VPC.

**So, can't I launch the Lambda function in my own VPC?**

**Tags:** security, aws-lambda, aws-vpc

> **Comments:**
> **username_1**: Short answer: no, as lambda code run on machines you don't have any idea of and managed directly by AWS. If you want to run your python lambda code within your VPC, you'll have to set-up an instance with python for this :)  
> **username_0**: @username_1 Apparently, it does :D. I blame the AWS docs for being unclear :D  

---

## 2 answers

### Answer by username_2 on 2017-06-22. Score: 3 | Accepted answer

The API for creating a function includes a section to choose which VPC to use for running that function.

source: <https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-CreateFunction-request-VpcConfig>

It doesn't have to be the default VPC, it can be any VPC.

Consider that "EC2 server inside a VPC" only means that it is some virtual machine that has a NIC connected to a network you have control over in your AWS account (the VPC).

With Lambda, you can choose to run functions on instances that have this NIC connected to a VPC under your control, or you can forego this control and let the Lambdas run where ever they usually do (default system-managed whatever) and just not care about it.


---

### Answer by username_0 on 2017-06-26. Score: 4

I have also asked the AWS Support folks for help too, as Lambda's security was crucial for us [HIPAA compliancy].

This was their response:

> Lambda has two options, you can have your lambda functions without a
> VPC or you could place your lambda function within a VPC. If you want
> to put your lambda function within VPC, then the most important thing
> to note is lambda function must be placed in private subnet. If you
> want to access internet resources from Lambda or make any AWS SDK API
> Calls, then you need to have the internet access for which you need to
> have a NAT Gateway or NAT Instance setup for the VPC, where your
> lambda function resides and have the private subnet point to the NAT
> Gateway. When lambda functions are placed within public subnet ( with
> an IGW route), then the lambda function won't work.

So, a lambda function can be put into a private subnet of a VPC, but not inside a public subnet. And for being able to create instances and ssh'ing into them, from this Lambda, add the private subnet to the security group of the public subnet [or another hacky way, is to add the VPC's IP range to the security group].

> **Comments:**
> **username_2**: To be exact, each Lambda has an ENI attached to it. And these ENIs never get assigned public IPs. So it is possible to start Lambdas in a Public subnet, but these wouldn't be receiving any public IPs so will only be able to communicate with other addresses within the same VPC.  And when the AWS account reaches the max ENIs limit ... you can imagine what happens ;)  
> **username_0**: @Evgeny Superbly explained [like always :D] . Thanks :)  

---

