AWS Lambda Function is not assigned to access within VPC misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_117
Category - Subcategory	Compute - Unsanctioned Resource Or Type
Provider	AWS
Severity	LOW
Framework	CloudFormation, Terraform, Terraform Plan

Impact

By default, Lambda runs functions in a secure VPC with access to AWS services and the internet. Lambda owns this VPC, which isn't connected to the account's default VPC. Internet access from a private subnet requires Network Address Translation (NAT). To give your function access to the internet, route outbound traffic to a NAT gateway in a public subnet.

How to Fix

To fix this issue, you should ensure that your AWS Lambda function configuration includes the VpcConfig property. Below is an example of how to set this property in a CloudFormation configuration:

Example: [source,go]

{ "Resources": { "ExampleLambdaFunction": { "Type": "AWS::Lambda::Function", "Properties": { "Handler": "index.handler", "Role": "arn:aws:iam::123456789012:role/lambda-role", "Code": { "S3Bucket": "my-bucket", "S3Key": "my-function.zip" }, "VpcConfig": { "SubnetIds": [ "subnet-0bb1c79de3EXAMPLE" ], "SecurityGroupIds": [ "sg-085912345678492fb" ] } } } } Resources: ExampleLambdaFunction: Type: AWS::Lambda::Function Properties: Handler: "index.handler" Role: "arn:aws:iam::123456789012:role/lambda-role" Code: S3Bucket: "my-bucket" S3Key: "my-function.zip" VpcConfig: SubnetIds:

• "subnet-0bb1c79de3EXAMPLE" SecurityGroupIds:
• "sg-085912345678492fb"

---