‫Okay, so let's practice Lambda in VPC.
‫So we'll author a Lambda function from scratch.
‫Call it Lambda VPC, runtime being Python 3.8
‫and create this function.
‫Also, let's go into the EC2 console
‫and we're going to create a security group
‫for our Lambda functions.
‫So I will go into the security groups UI.
‫Create a new security group,
‫and I'll call this one Lambda SG
‫and we'll attach it to the VPC we have.
‫We don't need any inbound rules and outbound rules.
‫The idea is just to show you, SG for Lambda,
‫the idea is just to have a security group
‫to attach your Lambda function.
‫Once that is deployed in our VPC.
‫Okay. So back into our Lambda function.
‫Now let's go into the configuration
‫and make sure that we can deploy this within our VPC
‫because right now the Lambda function is
‫within the AWS cloud and it has internet access
‫but it doesn't have VPC access.
‫So for this on the configuration,
‫on the left hand side, there is VPC.
‫We can edit this and choose a VPC
‫to attach our Lambda function to.
‫Now, there is a warning sign here,
‫which says that when you connect a function
‫to a VPC in your account,
‫which we are doing right now,
‫it does not have access to the internet
‫unless you provide your VPC access
‫which means that it needs to be
‫in a private subnets and you need to route
‫the outbound traffic to that gateway in a public subnet.
‫This is the only way of doing it.
‫Even if right now we publish our Lambda function
‫in three subnets, okay?
‫And these are public subnets
‫because they have access to the internet, as we know,
‫The Lambda function can still not have access
‫to the internet.
‫It needs instead to be published, deployed
‫into a private subnets and have a NAT gateway
‫or NAT instance in a public subnets to route traffic to.
‫So this is fine now,
‫because we're not going to access the internet
‫using a Lambda function.
‫And when you deploy a Lambda function
‫within the VPC usually is to do some local operations
‫for example, on your RDS database
‫or your elastic cache cluster.
‫Okay. So in terms of security group
‫then let's attach the Lambdas SG security group
‫we have from before
‫and the inbound rules and the outbound rules
‫would be helping in terms of defining access
‫to other services.
‫Actually, the inbound rules would be helpless
‫but the outbound rules may be helpful.
‫Okay. So let's click on save.
‫And now we can see that this doesn't work
‫because the Lambda function does not have the permissions
‫to call the create network interface on EC2.
‫Yes, because when you create a Lambda function in a VPC
‫then to be able to run, it needs to have network interfaces
‫and now they belong to you and to your VPC.
‫So we need to provide Lambda function
‫with enough permission to do so.
‫So let's open a new tab, configuration, permissions
‫and click on the role and the permission roles.
‫So let's attach a policy to our role
‫and I will just type in Lambda in here.
‫And in there we have a Lambda ENI management access.
‫So this one and we'll attach this policy.
‫And so if we look into the lambda ENI management access
‫this has all the necessary permission,
‫such as create network interface,
‫delete network interface, describing, and so on,
‫to be able to give our Lambda function
‫the rights to exist within our VPC.
‫So this is good to go.
‫Now let's click on save.
‫And our Lambda function is now deployed within our VPC.
‫So for this,
‫we just need to run the Lambda function and test it out.
‫So by the way, when you create a Lambda function in the VPC
‫it can take a little bit of time
‫to be updating and starting at first.
‫This is because a few things that should be set up by AWS
‫but then the performance of your Lambda function
‫should be okay.
‫So let's just wait for the other to be done.
‫So this took about three minutes
‫but my Lambda function is now updated.
‫And so I can just test it.
‫So let's go to this Lambda function and click on tests.
‫We'll create a sample events
‫and then click on creates, now test our function.
‫So the function has succeeded.
‫But the more interesting part is that
‫if we go into the management console of EC2
‫and we go under network interfaces,
‫as we can see here three network interfaces
‫have been created
‫and the disc respond to the network interfaces
‫of my Lambda function within my VPC.
‫So these network interfaces each in one different AC.
‫So each in one different subnets
‫is what allows my Lambda function
‫to communicate with our VPC.
‫So you can imagine having these ENIs and the security group,
‫having the necessary rules to access an RDS database
‫or an elastic cache cluster, for example.
‫So fairly simple but that's it for this demo.
‫I hope you liked it.
‫And I will see you in the next lecture.