Answers: <p>I have also asked the AWS Support folks for help too, as Lambda's security was crucial for us [HIPAA compliancy].</p>
  
  <p>This was their response:</p>
  
  <blockquote>
    <p>Lambda has two options, you can have your lambda functions without a
    VPC or you could place your lambda function within a VPC. If you want
    to put your lambda function within VPC, then the most important thing
    to note is lambda function must be placed in private subnet. If you
    want to access internet resources from Lambda or make any AWS SDK API
    Calls, then you need to have the internet access for which you need to
    have a NAT Gateway or NAT Instance setup for the VPC, where your
    lambda function resides and have the private subnet point to the NAT
    Gateway. When lambda functions are placed within public subnet ( with
    an IGW route), then the lambda function won't work.</p>
  </blockquote>
  
  <p>So, a lambda function can be put into a private subnet of a VPC, but not inside a public subnet. And for being able to create instances and ssh'ing into them, from this Lambda, add the private subnet to the security group of the public subnet [or another hacky way, is to add the VPC's IP range to the security group].</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-06-26T22:39:06.390Z
Answers: To be exact, each Lambda has an ENI attached to it. And these ENIs never get assigned public IPs. So it is possible to start Lambdas in a Public subnet, but these wouldn't be receiving any public IPs so will only be able to communicate with other addresses within the same VPC.
  
  And when the AWS account reaches the max ENIs limit ... you can imagine what happens ;)
Answers: Evgeny Zislis
Answers: CC BY-SA 3.0
Answers: 2017-06-29T11:59:49.367Z
Answers: @Evgeny Superbly explained [like always :D] . Thanks :)
Answers: Dawny33
Answers: CC BY-SA 3.0
Answers: 2017-06-26T05:34:32.880Z
Answers: 2017-06-26T05:34:32.880Z
Answers: Dawny33
Answers: <p>The API for creating a function includes a section to choose which VPC to use for running that function.</p>
  
  <p>source: <a href="https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-CreateFunction-request-VpcConfig" rel="nofollow noreferrer">https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-CreateFunction-request-VpcConfig</a></p>
  
  <p>It doesn't have to be the default VPC, it can be any VPC.</p>
  
  <p>Consider that "EC2 server inside a VPC" only means that it is some virtual machine that has a NIC connected to a network you have control over in your AWS account (the VPC).</p>
  
  <p>With Lambda, you can choose to run functions on instances that have this NIC connected to a VPC under your control, or you can forego this control and let the Lambdas run where ever they usually do (default system-managed whatever) and just not care about it.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-06-22T11:32:05.403Z
Answers: 2017-06-22T14:26:00.010Z
Answers: 2017-06-22T14:26:00.010Z
Answers: Evgeny Zislis
Body: <p>The VPC configurations option in Lambda tells this:</p>
  
  <blockquote>
    <p>All AWS Lambda functions run securely inside a default system-managed
    VPC. However, you can optionally configure Lambda to access resources,
    such as databases, within your custom VPC.</p>
  </blockquote>
  
  <p><strong>So, can't I launch the Lambda function in my own VPC?</strong></p>
  
Comments: CC BY-SA 3.0
Comments: 2017-06-22T09:07:53.260Z
Comments: Short answer: no, as lambda code run on machines you don't have any idea of and managed directly by AWS. If you want to run your python lambda code within your VPC, you'll have to set-up an instance with python for this :)
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-06-26T05:51:47.563Z
Comments: @Tensibai Apparently, it does :D. I blame the AWS docs for being unclear :D
Comments: Dawny33
Tags: <security><aws-lambda><aws-vpc>
Title: How do I launch Lambda in my own VPC?
UserDisplayName: Dawny33
ThreadText: # How do I launch Lambda in my own VPC?
  
  (Asked by: username_0 on 2017-06-22)
  
  The VPC configurations option in Lambda tells this:
  
  > All AWS Lambda functions run securely inside a default system-managed
  > VPC. However, you can optionally configure Lambda to access resources,
  > such as databases, within your custom VPC.
  
  **So, can't I launch the Lambda function in my own VPC?**
  
  **Tags:** security, aws-lambda, aws-vpc
  
  > **Comments:**
  > **username_1**: Short answer: no, as lambda code run on machines you don't have any idea of and managed directly by AWS. If you want to run your python lambda code within your VPC, you'll have to set-up an instance with python for this :)  
  > **username_0**: @username_1 Apparently, it does :D. I blame the AWS docs for being unclear :D  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2017-06-22. Score: 3 | Accepted answer
  
  The API for creating a function includes a section to choose which VPC to use for running that function.
  
  source: <https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-CreateFunction-request-VpcConfig>
  
  It doesn't have to be the default VPC, it can be any VPC.
  
  Consider that "EC2 server inside a VPC" only means that it is some virtual machine that has a NIC connected to a network you have control over in your AWS account (the VPC).
  
  With Lambda, you can choose to run functions on instances that have this NIC connected to a VPC under your control, or you can forego this control and let the Lambdas run where ever they usually do (default system-managed whatever) and just not care about it.
  
  
  ---
  
  ### Answer by username_0 on 2017-06-26. Score: 4
  
  I have also asked the AWS Support folks for help too, as Lambda's security was crucial for us [HIPAA compliancy].
  
  This was their response:
  
  > Lambda has two options, you can have your lambda functions without a
  > VPC or you could place your lambda function within a VPC. If you want
  > to put your lambda function within VPC, then the most important thing
  > to note is lambda function must be placed in private subnet. If you
  > want to access internet resources from Lambda or make any AWS SDK API
  > Calls, then you need to have the internet access for which you need to
  > have a NAT Gateway or NAT Instance setup for the VPC, where your
  > lambda function resides and have the private subnet point to the NAT
  > Gateway. When lambda functions are placed within public subnet ( with
  > an IGW route), then the lambda function won't work.
  
  So, a lambda function can be put into a private subnet of a VPC, but not inside a public subnet. And for being able to create instances and ssh'ing into them, from this Lambda, add the private subnet to the security group of the public subnet [or another hacky way, is to add the VPC's IP range to the security group].
  
  > **Comments:**
  > **username_2**: To be exact, each Lambda has an ENI attached to it. And these ENIs never get assigned public IPs. So it is possible to start Lambdas in a Public subnet, but these wouldn't be receiving any public IPs so will only be able to communicate with other addresses within the same VPC.  And when the AWS account reaches the max ENIs limit ... you can imagine what happens ;)  
  > **username_0**: @username_2 Superbly explained [like always :D] . Thanks :)  
  
  ---
  
  