How to set vpc, subnets and security groups in lambda functions when I'm using the cloudtrail mode?

[andersonfesilva]

Hello, I'm using cloudtrail mode to get events about "CreateUser" to force attach the BoundaryPolicy. This policy create a Lambda function, then I want that my lambda function has the network configuration: vpc, subnets and security group.

How do I declare the subnets and vpc in my policy?

[ajkerrigan]

You can configure the subnets and security groups of a VPC-attached Lambda functions in your policy's mode block:

mode:
  type: cloudtrail
  role: arn:aws:iam::{account_id}:role/custodian
  subnets:
    - subnet-08e48f...
  security_groups:
    - sg-01411f...

You don't explicitly provide the VPC ID, since it will be whichever VPC the subnets and security group belong to. You can see all of the available options for your policy mode by looking at the schema in the docs for the mode you're using (here that should be cloudtrail) or by running custodian schema mode.cloudtrail from the CLI.