Cloudformation Template for Public/Private VPC - Used to create peering connection between Lambda VPC and MongoDB Atlas, also allows public outbound traffic.

serverless.yml

service: project-vpc
variablesResolutionMode: 20210326

# Concepts From:
# https://raw.githubusercontent.com/awsdocs/aws-lambda-developer-guide/main/templates/vpc-privatepublic.yaml
# https://datachef.co/blog/aws-vpc-with-public-and-private-subnets/
# https://ordina-jworks.github.io/cloud/2020/02/19/Combining-MongoDB-and-AWS-Lambda.html#vpc-peering-connect-your-lambda-functions-with-your-mongodb-atlas-cluster

custom:
  stage: ${opt:stage}
  region: us-east-1
  platform: project
  vpcPeeringConnectionId: ${file(src/config.js):vpcPeeringConnectionId}
  vpcPeeringConnectionCidrBlock: ${file(src/config.js):vpcPeeringConnectionCidrBlock}
provider:
  name: aws
  runtime: nodejs14.x
  stage: "${self:custom.stage}"
  environment:
    SERVERLESS_ENV: "${self:custom.stage}"

functions:

resources:
  Resources:
    pubPrivateVPC:
      Type: AWS::EC2::VPC
      Properties:
        CidrBlock: 10.1.0.0/16
        EnableDnsSupport: true
        EnableDnsHostnames: true
        Tags:
          - Key: Name
            Value: !Ref AWS::StackName
    publicSubnet1:
      Type: AWS::EC2::Subnet
      Properties:
        VpcId: !Ref pubPrivateVPC
        AvailabilityZone:
          Fn::Select:
          - 0
          - Fn::GetAZs: ""
        CidrBlock: 10.1.10.0/24
        MapPublicIpOnLaunch: true
        Tags:
          - Key: Name
            Value: !Join ["-", [!Ref "AWS::StackName","public-subnet"]]
    privateSubnet1:
      Type: AWS::EC2::Subnet
      Properties:
        VpcId: !Ref pubPrivateVPC
        AvailabilityZone:
          Fn::Select:
          - 0
          - Fn::GetAZs: ""
        CidrBlock: 10.1.30.0/24
        MapPublicIpOnLaunch: false
        Tags:
          - Key: Name
            Value: !Join ["-", [!Ref "AWS::StackName","private-subnet-a"]]
    privateSubnet2:
      Type: AWS::EC2::Subnet
      Properties:
        VpcId: !Ref pubPrivateVPC
        AvailabilityZone:
          Fn::Select:
          - 1
          - Fn::GetAZs: ""
        CidrBlock: 10.1.40.0/24
        MapPublicIpOnLaunch: false
        Tags:
          - Key: Name
            Value: !Join ["-", [!Ref "AWS::StackName","private-subnet-b"]]
    internetGateway:
      Type: AWS::EC2::InternetGateway
      Properties:
        Tags:
          - Key: Name
            Value: !Join ["-", [!Ref "AWS::StackName","gateway"]]
    gatewayToInternet:
      Type: AWS::EC2::VPCGatewayAttachment
      Properties:
        VpcId: !Ref pubPrivateVPC
        InternetGatewayId: !Ref internetGateway
    publicRouteTable:
      Type: AWS::EC2::RouteTable
      Properties:
        VpcId: !Ref pubPrivateVPC
    publicRoute:
      Type: AWS::EC2::Route
      DependsOn: gatewayToInternet
      Properties:
        RouteTableId: !Ref publicRouteTable
        DestinationCidrBlock: 0.0.0.0/0
        GatewayId: !Ref internetGateway
    publicMongoRoute:
      Type: AWS::EC2::Route
      Properties:
        RouteTableId: !Ref publicRouteTable
        DestinationCidrBlock: "${self:custom.vpcPeeringConnectionCidrBlock}"
        VpcPeeringConnectionId: "${self:custom.vpcPeeringConnectionId}"
    publicSubnet1RouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        SubnetId: !Ref publicSubnet1
        RouteTableId: !Ref publicRouteTable
    natGateway:
      Type: AWS::EC2::NatGateway
      DependsOn: natPublicIP
      Properties:
        AllocationId: !GetAtt natPublicIP.AllocationId
        SubnetId: !Ref publicSubnet1
    natPublicIP:
      Type: AWS::EC2::EIP
      DependsOn: pubPrivateVPC
      Properties:
        Domain: vpc
    privateRouteTable:
      Type: AWS::EC2::RouteTable
      Properties:
        VpcId: !Ref pubPrivateVPC
    privateRoute:
      Type: AWS::EC2::Route
      Properties:
        RouteTableId: !Ref privateRouteTable
        DestinationCidrBlock: 0.0.0.0/0
        NatGatewayId: !Ref natGateway
    privateMongoRoute:
      Type: AWS::EC2::Route
      Properties:
        RouteTableId: !Ref privateRouteTable
        DestinationCidrBlock: "${self:custom.vpcPeeringConnectionCidrBlock}"
        VpcPeeringConnectionId: "${self:custom.vpcPeeringConnectionId}"
    privateSubnet1RouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        SubnetId: !Ref privateSubnet1
        RouteTableId: !Ref privateRouteTable
    privateSubnet2RouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        SubnetId: !Ref privateSubnet2
        RouteTableId: !Ref privateRouteTable
  Outputs:
    pubPrivateVPCID:
      Description: VPC ID
      Value: !Ref pubPrivateVPC
      Export:
        Name: !Join ["-", [!Ref "AWS::StackName","vpc"]]
    publicSubnet1ID:
      Description: Public Subnet A ID
      Value: !Ref publicSubnet1
      Export:
        Name: !Join ["-", [!Ref "AWS::StackName","public-subnet-a"]]
    privateSubnet1ID:
      Description: Private Subnet A ID
      Value: !Ref privateSubnet1
      Export:
        Name: !Join ["-", [!Ref "AWS::StackName","private-subnet-a"]]
    privateSubnet2ID:
      Description: Private Subnet B ID
      Value: !Ref privateSubnet2
      Export:
        Name: !Join ["-", [!Ref "AWS::StackName","private-subnet-b"]]
    privateVPCSecurityGroup:
      Description: Default security for Lambda VPC
      Value: !GetAtt pubPrivateVPC.DefaultSecurityGroup
      Export:
        Name: !Join ["-", [!Ref "AWS::StackName","vpc-sg"]]