Lion Cipher Lab

Put a Lambda in a VPC without breaking it (and without a costly NAT): the network perimeter

• Cloud Security
• Intermediate
• ~75 min
• Free · no account required

Why it matters

The execution-role lab taught you that in serverless the role is the IDENTITY perimeter. This is the other perimeter: the network. It matters because the moment a real project needs its function to reach a private database, someone attaches the Lambda to the company VPC — and one of two bad things happens. Either the function silently loses its internet and public-AWS-API access and starts timing out in ways nobody can explain, or someone 'fixes' that by bolting on a NAT Gateway and quietly signs the account up for a bill that runs every hour of every day forever, per-GB on top. Both failures…

What you'll learn

• why a default Lambda has internet egress and a VPC-attached one does not
• attaching a function to your own VPC (subnets + security group) with --vpc-config
• proving egress with a timed outbound call from inside the handler (checkip + an S3 API call)
• reading a connect timeout as the OBSERVABLE proof that a function lost its egress path
• how Lambda VPC networking really works: shared Hyperplane ENIs, ENIs in the subnets you pick
• that the function's SECURITY GROUP is your egress control (Lambda is the source)
• the egress menu and its costs: NAT Gateway (hourly + per-GB) vs VPC endpoints
• adding a FREE S3 gateway endpoint so the function reaches S3 privately with no internet
• why interface endpoints bill hourly but S3 and DynamoDB GATEWAY endpoints are free
• the judgment call: VPC-attach only to reach a private resource, never reflexively

Steps in this lab

1. The other perimeter: identity was rung one, the network is rung two
2. Set your Region, and sign the no-NAT contract before you touch anything
3. Build a throwaway VPC with ONE private subnet — and nothing that reaches the internet
4. Deploy a tiny function that TIMES its own egress — and prove it reaches out while unattached
5. Attach it to the private subnet — and watch both calls time out
6. What actually happened under the hood: Hyperplane ENIs and the security group as egress control
7. The egress menu: NAT Gateway (costs money) vs VPC endpoints (S3 gateway is FREE)
8. Add a FREE S3 gateway endpoint — and watch S3 come back while the internet stays dark
9. The judgment: should this function be in the VPC at all?
10. Tear it all down — and confirm no NAT, endpoint or leftover ENI is billing you

Open the full interactive lab →