1

The VPC configurations option in Lambda tells this:

All AWS Lambda functions run securely inside a default system-managed VPC. However, you can optionally configure Lambda to access resources, such as databases, within your custom VPC.

So, can't I launch the Lambda function in my own VPC?

Improve this question
2
  • Short answer: no, as lambda code run on machines you don't have any idea of and managed directly by AWS. If you want to run your python lambda code within your VPC, you'll have to set-up an instance with python for this :)
    – Tensibai
    Commented Jun 22, 2017 at 9:07
  • 1
    @Tensibai Apparently, it does :D. I blame the AWS docs for being unclear :D
    – Dawny33
    Commented Jun 26, 2017 at 5:51

2 Answers 2

Reset to default
3

The API for creating a function includes a section to choose which VPC to use for running that function.

source: https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-CreateFunction-request-VpcConfig

It doesn't have to be the default VPC, it can be any VPC.

Consider that "EC2 server inside a VPC" only means that it is some virtual machine that has a NIC connected to a network you have control over in your AWS account (the VPC).

With Lambda, you can choose to run functions on instances that have this NIC connected to a VPC under your control, or you can forego this control and let the Lambdas run where ever they usually do (default system-managed whatever) and just not care about it.

Improve this answer
0
4

I have also asked the AWS Support folks for help too, as Lambda's security was crucial for us [HIPAA compliancy].

This was their response:

Lambda has two options, you can have your lambda functions without a VPC or you could place your lambda function within a VPC. If you want to put your lambda function within VPC, then the most important thing to note is lambda function must be placed in private subnet. If you want to access internet resources from Lambda or make any AWS SDK API Calls, then you need to have the internet access for which you need to have a NAT Gateway or NAT Instance setup for the VPC, where your lambda function resides and have the private subnet point to the NAT Gateway. When lambda functions are placed within public subnet ( with an IGW route), then the lambda function won't work.

So, a lambda function can be put into a private subnet of a VPC, but not inside a public subnet. And for being able to create instances and ssh'ing into them, from this Lambda, add the private subnet to the security group of the public subnet [or another hacky way, is to add the VPC's IP range to the security group].

Improve this answer
2
  • 2
    To be exact, each Lambda has an ENI attached to it. And these ENIs never get assigned public IPs. So it is possible to start Lambdas in a Public subnet, but these wouldn't be receiving any public IPs so will only be able to communicate with other addresses within the same VPC. And when the AWS account reaches the max ENIs limit ... you can imagine what happens ;)
    – Evgeny Zislis
    Commented Jun 26, 2017 at 22:39
  • @Evgeny Superbly explained [like always :D] . Thanks :)
    – Dawny33
    Commented Jun 29, 2017 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.