{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/", "item": { "id": "https://update.dsesecurity.com/updates/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/", "slug": "restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc", "url": "https://update.dsesecurity.com/updates/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc.md", "json": "https://update.dsesecurity.com/api/v1/posts/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/" }, "title": "Restore required egress deliberately after connecting Lambda to a VPC", "summary": "A public subnet selection alone does not provide internet access to the function.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:58+00:00", "modified_at": "2026-10-20T18:34:29+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 249, "potentially_affected": "This concerns a VPC-connected Lambda function that needs approved external connectivity, with address-family and network design requirements checked separately.", "dse_recommendation": "DSE recommends listing external dependencies before changing the function network configuration.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc-internet.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A public subnet selection alone does not provide internet access to the function.

\n

Source facts

\n

AWS explains that adding a customer VPC configuration changes a Lambda function’s connectivity to that VPC unless an appropriate internet path is provided. Its internet-access procedure uses private subnets and the necessary routing resources. Connecting the function to a public subnet does not itself give the function internet access.

\n

Source: AWS Documentation.

\n

Applicability

\n

This concerns a VPC-connected Lambda function that needs approved external connectivity, with address-family and network design requirements checked separately.

\n

DSE recommendation

\n

DSE recommends listing external dependencies before changing the function network configuration. Distinguish private service access from public internet access, and review routes, NAT or relevant endpoint choices with the network owner. Keep security-group and DNS requirements alongside the subnet selection. Test the real dependency rather than only a generic website. Preserve the previous configuration and define how a failed deployment will be rolled back without exposing private resources more broadly. Create a dependency table that names the destination, DNS expectation and approved route owner. Have the application team identify which calls are essential during startup and failure recovery, then choose a bounded connectivity test for each before approving the network change.

\n

Verification

\n

Proposed verification: use an approved test function to reach its required private resource and harmless external endpoint. Inspect the selected subnet routes and observed failure stage if either call fails. Confirm an unapproved destination remains restricted according to the intended egress policy.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "A public subnet selection alone does not provide internet access to the function.\nSource facts\nAWS explains that adding a customer VPC configuration changes a Lambda function’s connectivity to that VPC unless an appropriate internet path is provided. Its internet-access procedure uses private subnets and the necessary routing resources. Connecting the function to a public subnet does not itself give the function internet access.\nSource: AWS Documentation.\nApplicability\nThis concerns a VPC-connected Lambda function that needs approved external connectivity, with address-family and network design requirements checked separately.\nDSE recommendation\nDSE recommends listing external dependencies before changing the function network configuration. Distinguish private service access from public internet access, and review routes, NAT or relevant endpoint choices with the network owner. Keep security-group and DNS requirements alongside the subnet selection. Test the real dependency rather than only a generic website. Preserve the previous configuration and define how a failed deployment will be rolled back without exposing private resources more broadly. Create a dependency table that names the destination, DNS expectation and approved route owner. Have the application team identify which calls are essential during startup and failure recovery, then choose a bounded connectivity test for each before approving the network change.\nVerification\nProposed verification: use an approved test function to reach its required private resource and harmless external endpoint. Inspect the selected subnet routes and observed failure stage if either call fails. Confirm an unapproved destination remains restricted according to the intended egress policy.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "A public subnet selection alone does not provide internet access to the function.\n\n## Source facts\n\nAWS explains that adding a customer VPC configuration changes a Lambda function’s connectivity to that VPC unless an appropriate internet path is provided. Its internet-access procedure uses private subnets and the necessary routing resources. Connecting the function to a public subnet does not itself give the function internet access.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc-internet.html).\n\n## Applicability\n\nThis concerns a VPC-connected Lambda function that needs approved external connectivity, with address-family and network design requirements checked separately.\n\n## DSE recommendation\n\nDSE recommends listing external dependencies before changing the function network configuration. Distinguish private service access from public internet access, and review routes, NAT or relevant endpoint choices with the network owner. Keep security-group and DNS requirements alongside the subnet selection. Test the real dependency rather than only a generic website. Preserve the previous configuration and define how a failed deployment will be rolled back without exposing private resources more broadly. Create a dependency table that names the destination, DNS expectation and approved route owner. Have the application team identify which calls are essential during startup and failure recovery, then choose a bounded connectivity test for each before approving the network change.\n\n## Verification\n\nProposed verification: use an approved test function to reach its required private resource and harmless external endpoint. Inspect the selected subnet routes and observed failure stage if either call fails. Confirm an unapproved destination remains restricted according to the intended egress policy.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc-internet.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/", "url": "https://update.dsesecurity.com/updates/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Restore required egress deliberately after connecting Lambda to a VPC", "item": "https://update.dsesecurity.com/updates/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/#article", "identifier": "https://update.dsesecurity.com/updates/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/", "url": "https://update.dsesecurity.com/updates/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/", "headline": "Restore required egress deliberately after connecting Lambda to a VPC", "description": "A public subnet selection alone does not provide internet access to the function.", "abstract": "A public subnet selection alone does not provide internet access to the function.", "articleBody": "A public subnet selection alone does not provide internet access to the function.\nSource facts\nAWS explains that adding a customer VPC configuration changes a Lambda function’s connectivity to that VPC unless an appropriate internet path is provided. Its internet-access procedure uses private subnets and the necessary routing resources. Connecting the function to a public subnet does not itself give the function internet access.\nSource: AWS Documentation.\nApplicability\nThis concerns a VPC-connected Lambda function that needs approved external connectivity, with address-family and network design requirements checked separately.\nDSE recommendation\nDSE recommends listing external dependencies before changing the function network configuration. Distinguish private service access from public internet access, and review routes, NAT or relevant endpoint choices with the network owner. Keep security-group and DNS requirements alongside the subnet selection. Test the real dependency rather than only a generic website. Preserve the previous configuration and define how a failed deployment will be rolled back without exposing private resources more broadly. Create a dependency table that names the destination, DNS expectation and approved route owner. Have the application team identify which calls are essential during startup and failure recovery, then choose a bounded connectivity test for each before approving the network change.\nVerification\nProposed verification: use an approved test function to reach its required private resource and harmless external endpoint. Inspect the selected subnet routes and observed failure stage if either call fails. Confirm an unapproved destination remains restricted according to the intended egress policy.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:58+00:00", "dateModified": "2026-10-20T18:34:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/restore-required-egress-deliberately-after-connecting-lambda-to-a-vpc/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Restore required egress deliberately after connecting Lambda to a VPC" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 249, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc-internet.html" } } ] } }