Lambda isBoundToVpc reports the wrong result

[holmesjr]

When creating a function connected to an imported VPC, the resulting template correctly assigns the subnets for the lambda, but the isBoundToVpc() method returns false and accessing the connections property of the lambda results in an error: "Only VPC-associated Lambda Functions have security groups to manage. Supply the "vpc" parameter when creating the Lambda, or "securityGroupId" when importing it."

The same happens when a new security group is attached.

Reproduction Steps

const vpc = Vpc.fromVpcAttributes(this, 'VPC', {
            vpcId: "xxxxx",
            availabilityZones: ["az1", "az2"],
            privateSubnetIds: ["sn1", "sn2"]
        });

const fn = new SingletonFunction(this, "MyFn",
            {
                functionName: `${props.stackName}-Fn`,
                description: "A Function",
                code: new AssetCode("../path/"),
                vpc: vpc,
                vpcSubnets: {
                    subnetType: SubnetType.PRIVATE
                },
                runtime: Runtime.PROVIDED,
                handler: "not-required",
                uuid: "762356a7-f95b-4ae2-98b3-6cebe95d12b3",
            });

const id = fn.connections.securityGroups[0].securityGroupId

Error Log

"Only VPC-associated Lambda Functions have security groups to manage. Supply the "vpc" parameter when creating the Lambda, or "securityGroupId" when importing it."

Environment

• CLI Version: 1.23.0 (build 01f326e)
• Framework Version: 1.23.0
• OS: MacOS
• Language: TypeScript

Other

---

This is 🐛 Bug Report

[JFox]

I bumped into this same issue. As a workaround you can use this:

  private ensureLambda(props: SingletonFunctionProps): IFunction {
    // TODO: Copy-pasted from CDK codebase until
    //       https://github.com/aws/aws-cdk/issues/6261 is fixed and we can
    //       use a proper SingletonFunction
    const constructName =
      (props.lambdaPurpose || 'SingletonLambda') + slugify(props.uuid);
    const existing = cdk.Stack.of(this).node.tryFindChild(constructName);
    if (existing) {
      return existing as FunctionBase;
    }
    return new Function(cdk.Stack.of(this), constructName, props);
  }

[yattoni]

@holmesjr, @JFox is this still an issue?

I added the following to the test/integ.vpc-lambda.ts after deploying it a first time to get the IDs and it works as expected.

const importedVpc = ec2.Vpc.fromVpcAttributes(stack, 'ImportedVPC', {
  vpcId: 'vpc-0adcxxxxxxxxx274',
  availabilityZones: ['us-east-2a', 'us-west-2b'],
  privateSubnetIds: ['subnet-09ea9xxxxxxxxx330df', 'subnet-0xxxxxxxxxxxb2'],
});

const imported = new lambda.Function(stack, 'ImportedVpcMyLambda', {
  code: new lambda.InlineCode('def main(event, context): pass'),
  handler: 'index.main',
  runtime: lambda.Runtime.PYTHON_3_6,
  vpc: importedVpc,
});

imported.connections.securityGroups[0].addIngressRule(ec2.Peer.anyIpv6(), ec2.Port.udp(8888));

    "ImportedVpcMyLambdaSecurityGroup76B6EDF3": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Automatic security group for Lambda Function awscdkvpclambdaImportedVpcMyLambda63B9D300",
        "SecurityGroupEgress": [
          {
            "CidrIp": "0.0.0.0/0",
            "Description": "Allow all outbound traffic by default",
            "IpProtocol": "-1"
          }
        ],
        "SecurityGroupIngress": [
          {
            "CidrIpv6": "::/0",
            "Description": "from ::/0:UDP 8888",
            "FromPort": 8888,
            "IpProtocol": "udp",
            "ToPort": 8888
          }
        ],
        "VpcId": "vpc-0adcxxxxxxxxx274"
      }
    },

[JFox]

@yattoni yes, the issue is still there. The problem is with the SingletonFunction resource, in your example you are creating a "regular" lambda, which works fine

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.