Lambda functions should be in a VPC

How to fix it

• Can break clients: Once attached, the function reaches only what the VPC can reach, so its internet and AWS API calls fail without a NAT gateway or VPC endpoints.
• Affects another check: Connecting the function brings it into Lambda.5, which fails unless its subnets span at least two Availability Zones.

In the console

Lambda → Functions → the function → Configuration → VPC

VPC

The VPC that holds the resources the function needs

Subnets

Private subnets in at least two Availability Zones

Security groups

At least one, allowing the traffic the function needs

Execution role

AWSLambdaVPCAccessExecutionRole attached, or the ec2 network interface permissions it grants

Aliases

Publish a new version and point each alias at it; published versions keep the old VPC settings

With the AWS CLI

aws lambda update-function-configuration --function-name <function-name> --vpc-config SubnetIds=<subnet-id-1>,<subnet-id-2>,SecurityGroupIds=<security-group-id> --region <region>

With Terraform

resource "aws_lambda_function" "this" {
  function_name = var.function_name
  role          = var.execution_role_arn
  filename      = var.deployment_package

  vpc_config {
    subnet_ids         = var.private_subnet_ids
    security_group_ids = var.security_group_ids
  }
}