VpcConfig leaves behind Network Interface about serverless-application-model

[dinvlad]

Cool, it's working correctly after today's intrinsic fix. Thanks!

[sanathkr]

Did you create the security groups outside of the template? CloudFormation cannot delete resources create outside of the template. You have to do it manually until the bug is fixed

[joekiller]

Yes they were created outside of the stack due to the issue #57

[sanathkr]

Yeah, then CloudFormation won't delete those resources. This is by design to let CloudFormation manage only resources that it creates

[joekiller]

Okay I'll try creating a SG and ingress rule on the existing SG in the template and see if the ENI gets deleted. Of course #57 might still prevent this.

[sanathkr]

Yes, #57 is on the works. It should prevent your problem. I am closing this issue for now.

[dinvlad]

The problem comes even when some "external" resources (e.g. subnets) are created via a custom resource in the same stack, e.g.

VpcConfig:
  SubnetIds: !GetAtt CustomSubnets.SubnetIds
  ...

Here my CustomSubnets resource creates a few subnets and exports their IDs via SubnetIds. The attribute gets resolved correctly (!), and Lambda is created successfully.

When I delete the stack, since this Lambda references CustomSubnets, it should be deleted before the latter, and then CustomSubnets would handle Delete request successfully by deleting associated subnets.

However, upon deletion of the stack the Delete request complains that its subnets are still associated with the Lambda's ENI. So there's no way to cleanly delete the stack.

[sanathkr]

Did you give your Lambda permission to delete the ENI? Checkout - http://docs.aws.amazon.com/lambda/latest/dg/vpc.html

[dinvlad]

Yes, it is assigned AWSLambdaVPCAccessExecutionRole