Adding custom cidr to ingress security group using Lambda without default vpc

Question

Hello all!
I have been searching the internet for this but I didn't exactly find a solution.

Basically I am trying to add custom cidr ips to a security group via lambda function. I have given all the appropriate permissions (as far as i can tell) . I even tried attaching the vpc (which is non-default) to the lambda function to access the security group but the error was the same so i removed it from lambda function.

But I am getting "An error occurred (VPCIdNotSpecified) when calling the AuthorizeSecurityGroupIngress operation: No default VPC for this user"

**Below is the Policy:**

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:RevokeSecurityGroupIngress",
                "ec2:CreateNetworkInterface",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeVpcs",
                "ec2:DeleteNetworkInterface",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:CreateLogGroup"
            ],
            "Resource":  "arn:aws:logs:us-west-2:xxxx:log-group:xxx:log-stream:*"
        }
    ]
}
```
**Lambda function:**
```
#!/usr/bin/python3.9
import boto3
ec2 = boto3.client('ec2')
def lambda_handler(event, context):
    response = ec2.authorize_security_group_ingress(
    GroupId='sg-xxxxxxx'
    IpPermissions=[
        { 
            'FromPort': 443,
            'IpProtocol': 'tcp',
            'IpRanges': [
                {
                    'CidrIp': '1x.1x.x.1x/32',
                    'Description': 'adding test cidr using lambda'
                },
            ],
            'ToPort': 443
        }
        ],
        DryRun=True
    )
    return response
```

Could someone point me to the right direction? VPC is non-defaul. All I need is to add ingress rule to an existing security group within a non-default vpc.

**The error log:**
```
Test Event Name
snstest

Response
{
  "errorMessage": "An error occurred (VPCIdNotSpecified) when calling the AuthorizeSecurityGroupIngress operation: No default VPC for this user",
  "errorType": "ClientError",
  "requestId": "7de9dce1-f2f9-4609-897e-b75ef751544e",
  "stackTrace": [
    "  File "/var/task/lambda_function.py", line 21, in lambda_handler
    response = ec2.authorize_security_group_ingress(
",
    "  File "/var/runtime/botocore/client.py", line 391, in _api_call
    return self._make_api_call(operation_name, kwargs)
",
    "  File "/var/runtime/botocore/client.py", line 719, in _make_api_call
    raise error_class(parsed_response, operation_name)
"
  ]
}

Function Logs
START RequestId: 7de9dce1-f2f9-4609-897e-b75ef751544e Version: $LATEST
[ERROR] ClientError: An error occurred (VPCIdNotSpecified) when calling the AuthorizeSecurityGroupIngress operation: No default VPC for this user
Traceback (most recent call last):
  File "/var/task/lambda_function.py", line 21, in lambda_handler
    response = ec2.authorize_security_group_ingress(
  File "/var/runtime/botocore/client.py", line 391, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/var/runtime/botocore/client.py", line 719, in _make_api_call
    raise error_class(parsed_response, operation_name)END RequestId: 7de9dce1-f2f9-4609-897e-b75ef751544e
REPORT RequestId: 7de9dce1-f2f9-4609-897e-b75ef751544e	Duration: 213.81 ms	Billed Duration: 214 ms	Memory Size: 128 MB	Max Memory Used: 77 MB

Request ID
7de9dce1-f2f9-4609-897e-b75ef751544e
```

Accepted Answer

It was syntax error, plus I added VPC to the configuration which was not required for this purpose. For anyone having the same issue (only want to update security group with the cidr): below is the correct function and permissions (function isnt complete as u may want to delete old rules too):

**Lambda function:**
```
#!/usr/bin/python3.9
import boto3
ec2 = boto3.client('ec2')
def lambda_handler(event, context):
    response = ec2.authorize_security_group_ingress(
        DryRun=False,
        GroupId='sg-0123456789',
        IpPermissions=[
            { 
                'FromPort': 443,
                'IpProtocol': 'tcp',
                'IpRanges': [
                    {
                        'CidrIp': '1x.2x.3x.4x/32',
                        'Description': 'Security group updated via lambda'
                    }
                ],
                'ToPort': 443
            }
        ]
    )
    return response
```
**IAM Policy on lambda execution role:**
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:ModifySecurityGroupRules",
                "ec2:UpdateSecurityGroupRuleDescriptionsIngress"
            ],
            "Resource": "arn or all"
        }
    ]
}
```

Answer

That code is fine. The error message is giving you the information that you need: There is no default VPC in the region that you're using. Yes, you're probably not using a default VPC but there are a few API calls that rely on having one even if you're not using it.

Try recreating your default VPC and see how you go: https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/

Answer

Hello

I copied your Script and tested it works pretty good without **DryRun flag** , I think you need to check permissions of Lambda,

Policy Used for the Lambda Function:

* Basic Lambda Execution Policy and
* Custom Policy below 
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:ModifySecurityGroupRules",
                "ec2:UpdateSecurityGroupRuleDescriptionsIngress"
            ],
            "Resource": "*"
        }
    ]
}
```
Please check the Role and attach the permission, Thank You

Adding custom cidr to ingress security group using Lambda without default vpc

Relevant content