Serverless best practice - LambdaInsideVpc

[dhoulker]

Hello,

We've recently started using this:

https://github.com/awslabs/aws-config-rules/blob/master/aws-config-conformance-packs/Operational-Best-Practices-for-Serverless.yaml

It's really helped us improve our serverless stack, but we also have a question.

As we understand it, Lambda functions run in a VPC by default, the VPC owned by the Lambda service.

So adding Lambdas to a VPC is not a Lambda security requirement

There are only a couple reasons you'd want to add the extra complexity of running a Lambda in your own VPC:

• You need to integrate with other private resources inside a VPC, eg ElasticCache or RDS.
• You have elevated compliance requirements, for example PCI DSS

If the above is correct, why is LambdaInsideVpc in the Operational Best Practices for Serverless ruleset?

Many thanks!