Assign Lambda Function To Specific VPC ID in serverless.yml

Question

I am using Serverless framework to deploy a Python lambda function to AWS. In my serverless.yml file I have defined a function which I need to deploy to a VPC with specific ID as only that VPC has network connectivity needed to make some business related requests from the lambda function.

  customer_callback:
    vpc:
      subnetIds:
        - subnet-something
    handler: myservice/event_stream.customer_callback

In the documentation, the above example is what they mention as a way to attach the function to a VPC:

https://serverless.com/framework/docs/providers/aws/guide/functions/

However, the function is not deployed to a VPC at all, e.g. I end up with:

I have tried specifying VPC ID directly like this:

  customer_callback:
    vpc:
      id: vpc-something
    handler: myservice/event_stream.customer_callback

But that does nothing as well. The documentation for this issue is basically non-existent and I tried searching a lot so I finally have to post here to ask for help.

Answer 1

From https://serverless.com/framework/docs/providers/aws/guide/functions/#vpc-configuration:

This object should contain the securityGroupIds and subnetIds array properties needed to construct VPC for this function.

functions:
  customer_callback:
    handler: myservice/event_stream.customer_callback
    vpc:
      securityGroupIds:
        - sg-deadbeef
      subnetIds:
        - subnet-fadecafe

You would also need to add VPC IAM Permissions.

The Lambda function execution role must have permissions to create, describe and delete Elastic Network Interfaces (ENI). When VPC configuration is provided the default AWS AWSLambdaVPCAccessExecutionRole will be associated with your Lambda execution role.

To do this, add the following in your serverless.yml:

resources:
  Resources:
    AWSLambdaVPCAccessExecutionRole:
      Type: AWS::IAM::ManagedPolicy
      Properties:
        Description: Creating policy for vpc connetion.
        Roles:
          - {"Ref" : "IamRoleLambdaExecution"}
        PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
                - ec2:CreateNetworkInterface
                - ec2:DescribeNetworkInterfaces
                - ec2:DeleteNetworkInterface
              Resource: "*"