Using vpc_config is not the only requirement for actually make lambdas work in a VPC

[fzipi]

Tried setting up lambdas in my vpc.

The result is that the role for lambdas execution doesn't have the proper permissions for it. Lambdas in a VPC will require additional permissions (and limitations) per https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html.

So lambdas need:

• attaching the AWSLambdaVPCAccessExecutionRole managed policy
• also, restrictions so the actual lambda cannot call the api to perform these:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [ 
                 "ec2:CreateNetworkInterface",
                 "ec2:DeleteNetworkInterface",
                 "ec2:DescribeNetworkInterfaces",
                 "ec2:DescribeSubnets",
                 "ec2:DetachNetworkInterface",
                 "ec2:AssignPrivateIpAddresses",
                 "ec2:UnassignPrivateIpAddresses"
            ],
            "Resource": [ "*" ],
            "Condition": {
                "ArnEquals": {
                    "lambda:SourceFunctionArn": [
                        "arn:aws:lambda:us-west-2:123456789012:function:my_function" <== here it goes the list of domain-protect functions
                    ]
                }
            }
        }
    ]
}