Lambda References VPC Resources Without VpcConfig
cross-resource-lambda-vpc-config-missing
What this rule checks
Detects Lambda functions that reference VPC-only resources (RDS, ElastiCache, Redshift, OpenSearch, ECS Service) but have no VpcConfig — the function cannot reach those private resources at runtime.
How to fix it
- 1Configure VpcConfig with appropriate SubnetIds and SecurityGroupIds on Lambda functions that reach VPC-only resources
CDK Insights pinpoints the exact file and line in your CDK source for every finding, so you can jump straight to the fix.
Affected resource types
AWS::Lambda::FunctionAWS::RDS::DBInstanceAWS::ElastiCache::CacheClusterAWS::Redshift::ClusterAWS::OpenSearchService::DomainAWS::Elasticsearch::DomainIntentional? Suppress this finding
Sometimes a flag is deliberate — a genuinely public endpoint, say. You can dismiss cross-resource-lambda-vpc-config-missing and the reason is kept in the report, not silently hidden.
In .cdk-insights.json:
{
"ignoreRules": [
{ "id": "cross-resource-lambda-vpc-config-missing", "reason": "Why this is intentional" }
]
}Or inline in your CDK code:
Validations.of(scope).acknowledge({
id: 'cdk-insights::cross-resource-lambda-vpc-config-missing',
reason: 'Why this is intentional',
});Use the rule ID cross-resource-lambda-vpc-config-missing shown above — not the CDK-* ID from SARIF / GitHub code scanning. To dismiss every finding on one construct instead, use ignorePaths. Suppression docs →
Catch this in your stack
$ npx cdk-insights scanCDK Insights runs this and 144+ other rules locally against your synthesised CDK app — free, no account, your code never leaves your machine.