> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Check vpc access remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration "Lambda Should Have Access To VPC-only Resources" for AWS using AWS console, you can follow the below steps: 1. Go to the AWS Lambda console. 2. Select the Lambda function that needs to access VPC-only resources. 3. Click on the "Configuration" tab. 4. Scroll down to the "Network" section. 5. Click on "Edit". 6. Select the VPC that has the required resources. 7. Select the subnets that the Lambda function needs to access. 8. If required, select the security groups that the Lambda function needs to access. 9. Click on "Save" to apply the changes. By following the above steps, the Lambda function will have access to VPC-only resources. # To remediate the misconfiguration "Lambda Should Have Access To VPC-only Resources" in AWS using AWS CLI, you can follow the below steps: 1. Open the AWS CLI on your local machine or EC2 instance. 2. Run the following command to create a new VPC configuration file: ``` aws ec2 create-vpc --cidr-block ``` Here, replace `` with the CIDR block range you want to use for your VPC. 3. Run the following command to create a new subnet within the VPC: ``` aws ec2 create-subnet --vpc-id --cidr-block ``` Here, replace `` with the ID of the VPC you created in step 2 and `` with the CIDR block range you want to use for your subnet. 4. Run the following command to create a new security group for the Lambda function: ``` aws ec2 create-security-group --group-name --description "" --vpc-id ``` Here, replace `` with the name you want to give your security group, `` with a brief description of the security group, and `` with the ID of the VPC you created in step 2. 5. Run the following command to modify the security group to allow inbound traffic from the VPC: ``` aws ec2 authorize-security-group-ingress --group-id --protocol all --cidr ``` Here, replace `` with the ID of the security group you created in step 4 and `` with the CIDR block range of the subnet you created in step 3. 6. Run the following command to create a new execution role for the Lambda function: ``` aws iam create-role --role-name --assume-role-policy-document file://trust-policy.json ``` Here, replace `` with the name you want to give your execution role and `trust-policy.json` with the file path to your trust policy document. 7. Run the following command to attach the necessary policies to the execution role: ``` aws iam attach-role-policy --role-name --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole ``` Here, replace `` with the name of the execution role you created in step 6. 8. Run the following command to update the Lambda function to use the VPC and security group: ``` aws lambda update-function-configuration --function-name --vpc-config SubnetIds=,SecurityGroupIds= --role ``` Here, replace `` with the name of the Lambda function you want to update, `` with the ID of the subnet you created in step 3, `` with the ID of the security group you created in step 4, and `` with the ARN of the execution role you created in step 6. 9. Run the following command to test the Lambda function to ensure it has access to VPC-only resources: ``` aws lambda invoke --function-name --payload '{}' output.json ``` Here, replace `` with the name of the Lambda function you updated in step 8. These steps should remediate the misconfiguration "Lambda Should Have Access To VPC-only Resources" in AWS using AWS CLI. To remediate the Lambda function not having access to VPC-only resources in AWS, you can follow the below steps: 1. Open the AWS Management Console and navigate to the Lambda service page. 2. Locate the Lambda function that needs to access VPC-only resources and click on it. 3. Click on the "Configuration" tab and scroll down to the "VPC" section. 4. Click on the "Edit" button to edit the VPC configuration. 5. Select the VPC that the Lambda function needs to access and select at least one subnet in each Availability Zone. 6. Select the security groups that allow access to the resources needed by the Lambda function. 7. Click on the "Save" button to save the updated VPC configuration. Now, the Lambda function will have access to VPC-only resources. Here is a sample Python code to create a Lambda function with access to VPC-only resources: ``` import boto3 def lambda_handler(event, context): # Create an EC2 client ec2 = boto3.client('ec2') # Describe instances in the VPC response = ec2.describe_instances() # Print the instances for reservation in response["Reservations"]: for instance in reservation["Instances"]: print(instance["InstanceId"]) ``` Make sure to attach the appropriate VPC and security group to the Lambda function while creating it. ```hcl theme={null} resource "aws_lambda_function" "FUNCTION_NAME" { function_name = "FUNCTION_NAME" # replace with your Lambda function name role = aws_iam_role.lambda_exec.arn handler = "INDEX.HANDLER" # replace with your handler runtime = "RUNTIME" # e.g., "nodejs20.x" # ... other arguments (filename/image_uri, env, timeout, etc.) # Connect the Lambda function to the specified VPC subnets and security groups vpc_config { subnet_ids = [aws_subnet.PRIVATE_SUBNET_1.id, aws_subnet.PRIVATE_SUBNET_2.id] # replace with your private subnet resources/IDs security_group_ids = [aws_security_group.LAMBDA_SG.id] # replace with your Lambda security group resource/ID } } resource "aws_iam_role" "lambda_exec" { name = "LAMBDA_EXEC_ROLE_NAME" # replace with your role name assume_role_policy = data.aws_iam_policy_document.lambda_assume_role.json } data "aws_iam_policy_document" "lambda_vpc_permissions" { statement { actions = [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", ] resources = ["*"] } } resource "aws_iam_role_policy" "lambda_vpc_permissions" { name = "lambda-vpc-permissions" role = aws_iam_role.lambda_exec.id policy = data.aws_iam_policy_document.lambda_vpc_permissions.json } ``` Replace: * `FUNCTION_NAME` with your Lambda function name. * `INDEX.HANDLER` and `RUNTIME` with your real handler and runtime. * `aws_subnet.PRIVATE_SUBNET_1/2` with your actual private subnet resources/IDs in the target VPC. * `aws_security_group.LAMBDA_SG` with the security group you want the Lambda to use. * `LAMBDA_EXEC_ROLE_NAME` with your Lambda execution role name. This change updates the Lambda configuration in place (no forced replacement of the function), but it will create and attach ENIs in your VPC when the function runs. Ensure those subnets have a route to a NAT Gateway if the function needs internet access. Verification: `terraform plan` should show an in-place update to `aws_lambda_function.FUNCTION_NAME` with `vpc_config.subnet_ids` and `vpc_config.security_group_ids` changing from `[]` (or null) to the specified subnet and security group IDs, plus creation/attachment of the IAM role policy if it did not exist.