---
title: "AWS Lambda Function is not assigned to access within VPC"
canonical: "https://kb.cynergy.app/space/MD/1208025091/AWS%20Lambda%20Function%20is%20not%20assigned%20to%20access%20within%20VPC"
format: markdown
---
Description

Lambda functions operate by default in a secure VPC managed by AWS with internet and service access. However, functions within a private subnet require a Network Address Translation (NAT) gateway to connect outbound traffic to the internet. To enable this, you need to route the function’s traffic through a NAT gateway in a public subnet.

# Fix - Build time

## Terraform

- **Resource:** aws_lambda_function
- **Argument:** vpc_config.subnet_ids
- For network connectivity to AWS resources in a VPC, specify a list of security groups and subnets in the VPC. When you connect a function to a VPC, it can only access resources and the internet through that VPC.  
`subnet_ids` - List of subnet IDs associated with the Lambda function.  
Note: If both subnet_ids and security_group_ids are empty then vpc_config is considered to be empty or unset.

```
resource "aws_lambda_function" "test_lambda" {
  ...
  vpc_config {
    // Every subnet should be able to reach an EFS mount target in the same Availability Zone. 
    // Cross-AZ mounts are not permitted.
+   subnet_ids         = [aws_subnet.subnet_for_lambda.id]
    security_group_ids = [aws_security_group.sg_for_lambda.id]
  }
}
```