feat: Lambda VPC Endpoint

examples/complete-vpc/main.tf

@@ -61,6 +61,11 @@ module "vpc" {
   ssm_endpoint_private_dns_enabled = true
   ssm_endpoint_security_group_ids  = [data.aws_security_group.default.id]
 
+  # VPC endpoint for Lambda
+  enable_lambda_endpoint              = true
+  lambda_endpoint_private_dns_enabled = true
+  lambda_endpoint_security_group_ids  = [data.aws_security_group.default.id]
+
   # VPC endpoint for SSMMESSAGES
   enable_ssmmessages_endpoint              = true
   ssmmessages_endpoint_private_dns_enabled = true
@@ -133,4 +138,3 @@ module "vpc" {
     Endpoint = "true"
   }
 }
-

examples/complete-vpc/outputs.tf

@@ -57,6 +57,21 @@ output "vpc_endpoint_ssm_dns_entry" {
   value       = module.vpc.vpc_endpoint_ssm_dns_entry
 }
 
+output "vpc_endpoint_lambda_id" {
+  description = "The ID of VPC endpoint for Lambda"
+  value       = module.vpc.vpc_endpoint_lambda_id
+}
+
+output "vpc_endpoint_lambda_network_interface_ids" {
+  description = "One or more network interfaces for the VPC Endpoint for Lambda."
+  value       = module.vpc.vpc_endpoint_lambda_network_interface_ids
+}
+
+output "vpc_endpoint_lambda_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for Lambda."
+  value       = module.vpc.vpc_endpoint_lambda_dns_entry
+}
+
 # Customer Gateway
 output "cgw_ids" {
   description = "List of IDs of Customer Gateway"

outputs.tf

@@ -513,6 +513,21 @@ output "vpc_endpoint_sqs_dns_entry" {
   value       = flatten(aws_vpc_endpoint.sqs.*.dns_entry)
 }
 
+output "vpc_endpoint_lambda_id" {
+  description = "The ID of VPC endpoint for Lambda"
+  value       = concat(aws_vpc_endpoint.lambda.*.id, [""])[0]
+}
+
+output "vpc_endpoint_lambda_network_interface_ids" {
+  description = "One or more network interfaces for the VPC Endpoint for Lambda."
+  value       = flatten(aws_vpc_endpoint.lambda.*.network_interface_ids)
+}
+
+output "vpc_endpoint_lambda_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for Lambda."
+  value       = flatten(aws_vpc_endpoint.lambda.*.dns_entry)
+}
+
 output "vpc_endpoint_codebuild_id" {
   description = "The ID of VPC endpoint for codebuild"
   value       = concat(aws_vpc_endpoint.codebuild.*.id, [""])[0]

variables.tf

@@ -490,6 +490,30 @@ variable "sqs_endpoint_private_dns_enabled" {
   default     = false
 }
 
+variable "enable_lambda_endpoint" {
+  description = "Should be true if you want to provision a Lambda endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "lambda_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for Lambda endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "lambda_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for Lambda endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "lambda_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for Lambda endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "enable_ssm_endpoint" {
   description = "Should be true if you want to provision an SSM endpoint to the VPC"
   type        = bool

vpc-endpoints.tf

@@ -1,3 +1,5 @@
+data "aws_region" "current" {}
+
 ######################
 # VPC Endpoint for S3
 ######################
@@ -185,6 +187,22 @@ resource "aws_vpc_endpoint" "sqs" {
   tags                = local.vpce_tags
 }
 
+#########################
+# VPC Endpoint for Lambda
+#########################
+resource "aws_vpc_endpoint" "lambda" {
+  count = var.create_vpc && var.enable_lambda_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = format("com.amazonaws.%s.lambda", data.aws_region.current.name)
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.lambda_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.lambda_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.lambda_endpoint_private_dns_enabled
+  tags                = local.vpce_tags
+}
+
 ###################################
 # VPC Endpoint for Secrets Manager
 ###################################