Skip to main content

🛡️ AWS Lambda Function is not in a VPC🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Lambda functions that are not configured to run within a Virtual Private Cloud (VPC). By default, Lambda functions run in a managed AWS environment and do not have access to private resources within your VPC.

Lambda@Edge functions do not support VPC configuration and therefore cannot be attached to a VPC.

Rationale​

Running Lambda functions within a VPC enables secure access to private resources such as Amazon RDS, Amazon ElastiCache, and internal APIs. It also allows the use of security groups and network ACLs, and enables outbound traffic to be routed through a NAT Gateway for IP-based allowlisting.

Audit​

This policy flags an AWS Lambda Function as INCOMPLIANT when the VPC ID field is empty.

Lambda@Edge functions are marked as INAPPLICABLE, as VPC attachment is not supported for Lambda@Edge.

Remediation​

Open File

Remediation​

Attach a Lambda Function to a VPC​

Configure the Lambda function to run within a Virtual Private Cloud (VPC) by associating it with the appropriate subnets and security groups. Ensure the selected subnets have network connectivity to the required resources.

From Command Line​

Use the update-function-configuration command with the --vpc-config parameter:

aws lambda update-function-configuration \
    --function-name {{function-name}} \
    --vpc-config SubnetIds=subnet-id1,subnet-id2,SecurityGroupIds=sg-id
Notes​
  • Select private subnets that provide access to required resources such as Amazon RDS, ElastiCache, or internal services.
  • Ensure the associated security group allows the necessary inbound and outbound traffic.
  • If the function requires outbound internet access, configure a NAT Gateway in the VPC.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 Cloudaware Framework → 💼 Secure Access68no data
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)3780no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)23799no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1158no data
💼 FedRAMP High Security Controls → 💼 AC-6 Least Privilege (M)(H)81171no data
💼 FedRAMP High Security Controls → 💼 AC-21 Information Sharing (M)(H)16no data
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10877no data
💼 FedRAMP High Security Controls → 💼 SC-7(3) Access Points (M)(H)16no data
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)44no data
💼 FedRAMP High Security Controls → 💼 SC-7(20) Dynamic Isolation and Segregation (H)16no data
💼 FedRAMP High Security Controls → 💼 SC-7(21) Isolation of System Components (H)33no data
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)80no data
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)45no data
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)80no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)183no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)58no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6 Least Privilege (M)(H)671no data
💼 FedRAMP Moderate Security Controls → 💼 AC-21 Information Sharing (M)(H)16no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)763no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(3) Access Points (M)(H)16no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)44no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events167no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events168no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained84no data
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties128no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected178no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected154no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected174no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage116no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3 Access Enforcement15553no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(7) Access Enforcement _ Role-based Access Control26no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement3269114no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3758no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6 Least Privilege102364no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-21 Information Sharing216no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection29484no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(3) Boundary Protection _ Access Points16no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services44no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic27no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic33no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(16) Boundary Protection _ Prevent Discovery of System Components34no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(20) Boundary Protection _ Dynamic Isolation and Segregation16no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(21) Boundary Protection _ Isolation of System Components33no data
💼 PCI DSS v3.2.1 → 💼 1.2.1 Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic.1062no data
💼 PCI DSS v3.2.1 → 💼 1.3.1 Implement a DMZ to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports.626no data
💼 PCI DSS v3.2.1 → 💼 1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ.26no data
💼 PCI DSS v3.2.1 → 💼 1.3.4 Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet.13no data
💼 PCI DSS v3.2.1 → 💼 1.3.5 Permit only “established” connections into the network.26no data
💼 PCI DSS v4.0.1 → 💼 1.3.1 Inbound traffic to the CDE is restricted.62no data
💼 PCI DSS v4.0.1 → 💼 1.3.2 Outbound traffic from the CDE is restricted.62no data
💼 PCI DSS v4.0.1 → 💼 1.4.2 Inbound traffic from untrusted networks to trusted networks is restricted.26no data
💼 PCI DSS v4.0 → 💼 1.3.1 Inbound traffic to the CDE is restricted.762no data
💼 PCI DSS v4.0 → 💼 1.3.2 Outbound traffic from the CDE is restricted.62no data
💼 PCI DSS v4.0 → 💼 1.4.2 Inbound traffic from untrusted networks to trusted networks is restricted.726no data