Currently, one portion of the cache configuration (inbound security group rules) is left out of the CDK setup because I was initially worried about circular references. However I think I was unclear about some CDK functionality because it should be possible to include.
[ ] create a security group to be used by the lambda (only needs allowAllOutbound); we need the reference to the lambda security group later and currently there is no method to get this from an automatically generated security group on lambda in VPC creation.
[ ] call the sg.addIngressRule method on the cache security group to add ingress from the lambda function's security group created above
Additional related improvements:
[ ] the two policies that are added to the lambda role have unhelpful names (iam_policy_statement and vpc_access_policy_statement); probably worth coming up with something better for future readers
Currently, one portion of the cache configuration (inbound security group rules) is left out of the CDK setup because I was initially worried about circular references. However I think I was unclear about some CDK functionality because it should be possible to include.
allowAllOutbound); we need the reference to the lambda security group later and currently there is no method to get this from an automatically generated security group on lambda in VPC creation.sg.addIngressRulemethod on the cache security group to add ingress from the lambda function's security group created aboveAdditional related improvements:
iam_policy_statementandvpc_access_policy_statement); probably worth coming up with something better for future readerscc: @leothomas