aws-lambda: VpcConfig is not configured for Lambda Function without specifying Vpc prop

[longtv2222]

Describe the bug

Specifying securityGroups without specifying vpc prop in Lambda Function leads to VpcConfig not added to the generated CloudFormation Template.

Expected Behavior

VpcConfig is added to Lambda Function:

  "functionF19B1A04": {
   "Type": "AWS::Lambda::Function",
   "Properties": {
    "Code": {
     "ZipFile": "..."
    },
    "Handler": "index.handler",
    "Role": {
     "Fn::GetAtt": [
      "functionServiceRoleEF216095",
      "Arn"
     ]
    },
    "Runtime": "nodejs18.x",
    "VpcConfig": { // VpcConfig is added here
        ...
    }
   },
   "DependsOn": [
    ...
   ]

Current Behavior

VpcConfig is not in Lambda Function

  "functionF19B1A04": {
   "Type": "AWS::Lambda::Function",
   "Properties": {
    "Code": {
     "ZipFile": "..."
    },
    "Handler": "index.handler",
    "Role": {
     "Fn::GetAtt": [
      "functionServiceRoleEF216095",
      "Arn"
     ]
    },
    "Runtime": "nodejs18.x"
   },
   "DependsOn": [
    "functionServiceRoleEF216095"
   ],
   "Metadata": {
    "aws:cdk:path": "TestStack/function/Resource"
   }
  },

Reproduction Steps

The following code does not add VpcConfig to CloudFormation template for Lambda function:

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2'
import * as lambda from 'aws-cdk-lib/aws-lambda';

export class TestStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const vpc = new ec2.Vpc(this, "vpc");
    const sg = new ec2.SecurityGroup(this, "sg", {
      vpc
    });

    const fn = new lambda.Function(this, 'function', {
      runtime: lambda.Runtime.NODEJS_18_X,
      handler: 'index.handler',
      code: lambda.Code.fromInline("..."),
      securityGroups:[sg],
    });
  }
}

However, by adding vpc to props, now VpcConfig is added to the CloudFormation template

    const fn = new lambda.Function(this, 'function', {
      runtime: lambda.Runtime.NODEJS_18_X,
      handler: 'index.handler',
      code: lambda.Code.fromInline("..."),
      securityGroups:[sg],
      vpc, // Add vpc to prop
    });

Possible Solution

securityGroup (no s) is deprecated and CDK is not throwing error if securityGroups is specified and vpc is not specified

aws-cdk/packages/aws-cdk-lib/aws-lambda/lib/function.ts

Lines 1225 to 1227 in 39a1d6b

	if ((props.securityGroup || props.allowAllOutbound !== undefined) && !props.vpc) {
	throw new Error('Cannot configure \'securityGroup\' or \'allowAllOutbound\' without configuring a VPC');
	}

Additional Information/Context

No response

CDK CLI Version

2.87.0

Framework Version

No response

Node.js Version

18

OS

Window

Language

Typescript

Language Version

No response

Other information

No response

[pahud]

Agree. configureVpc() will only be executed if props.vpc is provided. We need a check when props.securityGroup is provided and vpc undefined.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[mbhaalalhhaexchange]

When we are using the Security group without VPC for @aws-cdk/aws-lambda package it was working well but when we have migrate it to the aws-cdk-lib/aws-lambda package we are getting following error message,
Cannot configure 'securityGroups' without configuring a VPC

Kindly suggest the possible solution for it.