I have also asked the AWS Support folks for help too, as Lambda's security was crucial for us [HIPAA compliancy].
This was their response:
Lambda has two options, you can have your lambda functions without a
VPC or you could place your lambda function within a VPC. If you want
to put your lambda function within VPC, then the most important thing
to note is lambda function must be placed in private subnet. If you
want to access internet resources from Lambda or make any AWS SDK API
Calls, then you need to have the internet access for which you need to
have a NAT Gateway or NAT Instance setup for the VPC, where your
lambda function resides and have the private subnet point to the NAT
Gateway. When lambda functions are placed within public subnet ( with
an IGW route), then the lambda function won't work.
So, a lambda function can be put into a private subnet of a VPC, but not inside a public subnet. And for being able to create instances and ssh'ing into them, from this Lambda, add the private subnet to the security group of the public subnet [or another hacky way, is to add the VPC's IP range to the security group].