Lambda Should Have Access To VPC-only Resources

Using Console

To remediate the misconfiguration “Lambda Should Have Access To VPC-only Resources” for AWS using AWS console, you can follow the below steps:

Go to the AWS Lambda console.
Select the Lambda function that needs to access VPC-only resources.
Click on the “Configuration” tab.
Scroll down to the “Network” section.
Click on “Edit”.
Select the VPC that has the required resources.
Select the subnets that the Lambda function needs to access.
If required, select the security groups that the Lambda function needs to access.
Click on “Save” to apply the changes.

By following the above steps, the Lambda function will have access to VPC-only resources.

Using CLI

To remediate the misconfiguration “Lambda Should Have Access To VPC-only Resources” in AWS using AWS CLI, you can follow the below steps:

Open the AWS CLI on your local machine or EC2 instance.
Run the following command to create a new VPC configuration file:

aws ec2 create-vpc --cidr-block <CIDR_BLOCK>

Here, replace <CIDR_BLOCK> with the CIDR block range you want to use for your VPC.

Run the following command to create a new subnet within the VPC:

aws ec2 create-subnet --vpc-id <VPC_ID> --cidr-block <SUBNET_CIDR_BLOCK>

Here, replace <VPC_ID> with the ID of the VPC you created in step 2 and <SUBNET_CIDR_BLOCK> with the CIDR block range you want to use for your subnet.

Run the following command to create a new security group for the Lambda function:

aws ec2 create-security-group --group-name <SECURITY_GROUP_NAME> --description "<SECURITY_GROUP_DESCRIPTION>" --vpc-id <VPC_ID>

Here, replace <SECURITY_GROUP_NAME> with the name you want to give your security group, <SECURITY_GROUP_DESCRIPTION> with a brief description of the security group, and <VPC_ID> with the ID of the VPC you created in step 2.

Run the following command to modify the security group to allow inbound traffic from the VPC:

aws ec2 authorize-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol all --cidr <SUBNET_CIDR_BLOCK>

Here, replace <SECURITY_GROUP_ID> with the ID of the security group you created in step 4 and <SUBNET_CIDR_BLOCK> with the CIDR block range of the subnet you created in step 3.

Run the following command to create a new execution role for the Lambda function:

aws iam create-role --role-name <ROLE_NAME> --assume-role-policy-document file://trust-policy.json

Here, replace <ROLE_NAME> with the name you want to give your execution role and trust-policy.json with the file path to your trust policy document.

Run the following command to attach the necessary policies to the execution role:

aws iam attach-role-policy --role-name <ROLE_NAME> --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole

Here, replace <ROLE_NAME> with the name of the execution role you created in step 6.

Run the following command to update the Lambda function to use the VPC and security group:

aws lambda update-function-configuration --function-name <FUNCTION_NAME> --vpc-config SubnetIds=<SUBNET_ID>,SecurityGroupIds=<SECURITY_GROUP_ID> --role <ROLE_ARN>

Here, replace <FUNCTION_NAME> with the name of the Lambda function you want to update, <SUBNET_ID> with the ID of the subnet you created in step 3, <SECURITY_GROUP_ID> with the ID of the security group you created in step 4, and <ROLE_ARN> with the ARN of the execution role you created in step 6.

Run the following command to test the Lambda function to ensure it has access to VPC-only resources:

aws lambda invoke --function-name <FUNCTION_NAME> --payload '{}' output.json

Here, replace <FUNCTION_NAME> with the name of the Lambda function you updated in step 8.These steps should remediate the misconfiguration “Lambda Should Have Access To VPC-only Resources” in AWS using AWS CLI.

Using Python

To remediate the Lambda function not having access to VPC-only resources in AWS, you can follow the below steps:

Open the AWS Management Console and navigate to the Lambda service page.
Locate the Lambda function that needs to access VPC-only resources and click on it.
Click on the “Configuration” tab and scroll down to the “VPC” section.
Click on the “Edit” button to edit the VPC configuration.
Select the VPC that the Lambda function needs to access and select at least one subnet in each Availability Zone.
Select the security groups that allow access to the resources needed by the Lambda function.
Click on the “Save” button to save the updated VPC configuration.

Now, the Lambda function will have access to VPC-only resources.Here is a sample Python code to create a Lambda function with access to VPC-only resources:

import boto3

def lambda_handler(event, context):
    # Create an EC2 client
    ec2 = boto3.client('ec2')
    
    # Describe instances in the VPC
    response = ec2.describe_instances()
    
    # Print the instances
    for reservation in response["Reservations"]:
        for instance in reservation["Instances"]:
            print(instance["InstanceId"])

Make sure to attach the appropriate VPC and security group to the Lambda function while creating it.

Using Terraform

resource "aws_lambda_function" "FUNCTION_NAME" {
  function_name = "FUNCTION_NAME" # replace with your Lambda function name
  role          = aws_iam_role.lambda_exec.arn
  handler       = "INDEX.HANDLER" # replace with your handler
  runtime       = "RUNTIME"       # e.g., "nodejs20.x"

  # ... other arguments (filename/image_uri, env, timeout, etc.)

  # Connect the Lambda function to the specified VPC subnets and security groups
  vpc_config {
    subnet_ids         = [aws_subnet.PRIVATE_SUBNET_1.id, aws_subnet.PRIVATE_SUBNET_2.id] # replace with your private subnet resources/IDs
    security_group_ids = [aws_security_group.LAMBDA_SG.id]                                # replace with your Lambda security group resource/ID
  }
}

resource "aws_iam_role" "lambda_exec" {
  name               = "LAMBDA_EXEC_ROLE_NAME" # replace with your role name
  assume_role_policy = data.aws_iam_policy_document.lambda_assume_role.json
}

data "aws_iam_policy_document" "lambda_vpc_permissions" {
  statement {
    actions = [
      "ec2:CreateNetworkInterface",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DeleteNetworkInterface",
    ]

    resources = ["*"]
  }
}

resource "aws_iam_role_policy" "lambda_vpc_permissions" {
  name   = "lambda-vpc-permissions"
  role   = aws_iam_role.lambda_exec.id
  policy = data.aws_iam_policy_document.lambda_vpc_permissions.json
}

Replace:

FUNCTION_NAME with your Lambda function name.
INDEX.HANDLER and RUNTIME with your real handler and runtime.
aws_subnet.PRIVATE_SUBNET_1/2 with your actual private subnet resources/IDs in the target VPC.
aws_security_group.LAMBDA_SG with the security group you want the Lambda to use.
LAMBDA_EXEC_ROLE_NAME with your Lambda execution role name.

This change updates the Lambda configuration in place (no forced replacement of the function), but it will create and attach ENIs in your VPC when the function runs. Ensure those subnets have a route to a NAT Gateway if the function needs internet access.Verification: terraform plan should show an in-place update to aws_lambda_function.FUNCTION_NAME with vpc_config.subnet_ids and vpc_config.security_group_ids changing from [] (or null) to the specified subnet and security group IDs, plus creation/attachment of the IAM role policy if it did not exist.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Lambda Should Have Access To VPC-only Resources

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: