Enable ability to deploy terminate-instances lambda to VPC

[jreading]

Information Security teams are asking for Lambdas to always be deployed in VPCs. Any thought on adding that feature for the lambdas used by the terminate-agent-hook?

[kayman-mk]

Could you please shed some light on this? The Lambda does not process any sensitive data. So it should be fine to run outside the VPC.

[jreading]

Of course, but blanket compliance checks in enterprise environments always seem to lead to "non-compliance exceptions" and overhead. It would be great to just say "all our lambdas are in the VPC" 100%.

[jreading]

For more context, here's a rule in AWS config that is designed to meet FedRamp compliance:
https://docs.aws.amazon.com/config/latest/developerguide/lambda-inside-vpc.html

The mapping for FedRamp Moderate to AWS Config compliance packs:
https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-fedramp-moderate.html

[npalm]

@jreading for another module I maintain, I received in the past a similar request. The requirement to run the lamda's in a dedicated VPC. For that module, same as this one the network is a general a given. You inject the VPC. For this GitHub runner module via a PR the option is added to inject VPC config to deploy Lambda's attached to a VPC. Setting up the right VPC config is not scope of the module.

Here you can find for the GitHub module the relevant part of the code:
https://github.com/philips-labs/terraform-aws-github-runner/blob/4c50a044ac906a2d1cd685419f04b5b79eb7763c/modules/runner-binaries-syncer/runner-binaries-syncer.tf#L37-L43

Would you have the option to propose the change, to add the option to deploy the Lambda's in a VPC. Default should be standard, not deployed to dedicated VPC.