title: how to put the lambda in VPC by CloudFormation template
body: <p>I am developping lambda with <code>CloudFormation</code> by <code>SAM</code></p>
  <p>My <code>template.yaml</code> is here.</p>
  <p>It can be deployed, however this lambda is not set in VPC.</p>
  <p>I want to put the lambda in default VPC (to access RDS)</p>
  <p>Any setting can be used here or I should do something another??</p>
  <p>(And, template makes <code>IAmRole</code> automatically, is there any way I can attach policy to it?? for example <code>RDSFullAccess</code>)</p>
  <pre><code>AWSTemplateFormatVersion: '2010-09-09'
  Transform: AWS::Serverless-2016-10-31
  Description: &gt;
    python3.9   Sample SAM Template for chatbot-sam
  
  Parameters:
    DBNAME:
      Type: String
    DBUSER:
      Type: String
    DBPASSWORD:
      Type: String
    DBHOST:
      Type: String
    DBPORT:
      Type: String
    LINELONGLIVETOKEN:
      Type: String
  Globals:
    Function:
      Timeout: 30
      Environment:
        Variables:
          DBNAME: !Ref DBNAME
          DBUSER: !Ref DBUSER
          DBPASSWORD: !Ref DBPASSWORD
          DBHOST: !Ref DBHOST
          DBPORT: !Ref DBPORT  
          LINELONGLIVETOKEN: !Ref LINELONGLIVETOKEN  
  Resources:
    WebhookFunction:
      Type: AWS::Serverless::Function 
      Properties:
        PackageType: Image
        Architectures:
          - x86_64
        Events:
          Webhook:
            Type: Api 
            Properties:
              Path: /webhook
              Method: post
      Metadata:
        Dockerfile: Dockerfile.webhook
        DockerContext: ./chatbotapp
        DockerTag: python3.9-v1
  
  
  
  
  Outputs:
    WebhookApi:
      Description: &quot;API Gateway endpoint URL for Prod stage for Hello World function&quot;
      Value: !Sub &quot;https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/webhook/&quot;
    WebhookFunction:
      Description: &quot;Webhook Lambda Function ARN&quot;
      Value: !GetAtt WebhookFunction.Arn
    WebhookFunctionIamRole:
      Description: &quot;Implicit IAM Role created for Webhook function&quot;
      Value: !GetAtt WebhookFunctionRole.Arn
  </code></pre>
  <p>I updated.</p>
  <p>Attaches <code>VpcConfig</code> and <code>Policies</code> , however it doesn't look change.</p>
  <p>lambda -&gt; setting -&gt; vpc, there is no vpc setting and can't find the clue it belongs to SecurityGroup and Subnet</p>
  <pre><code>  Policies: AWSLambdaVPCAccessExecutionRole
    VpcConfig:
      SubnetIds:
        - subnet-fb6fa4d0
        - subnet-bf8ab8e4
      SecurityGroupIds:
        - sg-0641506b4ec3782de
  
  
  AWSTemplateFormatVersion: '2010-09-09'
  Transform: AWS::Serverless-2016-10-31
  Description: &gt;
    python3.9   Sample SAM Template for chatbot-sam
  
  Parameters:
    DBNAME:
      Type: String
    DBUSER:
      Type: String
    DBPASSWORD:
      Type: String
    DBHOST:
      Type: String
    DBPORT:
      Type: String
    LINELONGLIVETOKEN:
      Type: String
  Globals:
    Function:
      Timeout: 30
      Environment:
        Variables:
          DBNAME: !Ref DBNAME
          DBUSER: !Ref DBUSER
          DBPASSWORD: !Ref DBPASSWORD
          DBHOST: !Ref DBHOST
          DBPORT: !Ref DBPORT  
          LINELONGLIVETOKEN: !Ref LINELONGLIVETOKEN  
  Resources:
    WebhookFunction:
      Type: AWS::Serverless::Function 
      Properties:
        PackageType: Image
        Architectures:
          - x86_64
        Events:
          Webhook:
            Type: Api 
            Properties:
              Path: /webhook
              Method: post
        Policies: AWSLambdaVPCAccessExecutionRole
        VpcConfig:
          SubnetIds:
            - subnet-fb6fa4d0
            - subnet-bf8ab8e4
          SecurityGroupIds:
            - sg-0641506b4ec3782de
      Metadata:
        Dockerfile: Dockerfile.webhook
        DockerContext: ./chatbotapp
        DockerTag: python3.9-v1
  
  
  
  
  Outputs:
    WebhookApi:
      Description: &quot;API Gateway endpoint URL for Prod stage for Hello World function&quot;
      Value: !Sub &quot;https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/webhook/&quot;
    WebhookFunction:
      Description: &quot;Webhook Lambda Function ARN&quot;
      Value: !GetAtt WebhookFunction.Arn
    WebhookFunctionIamRole:
      Description: &quot;Implicit IAM Role created for Webhook function&quot;
      Value: !GetAtt WebhookFunctionRole.Arn
  </code></pre>