I'm designing a HIPAA-compliant healthcare web application using CloudFront and S3, Cognito, API Gateway with Cognito authorization, Lambda for API processing and sensitive-field encryption, DynamoDB, KMS, CloudTrail, and encrypted parameter storage. I understand that HIPAA compliance also involves controls such as TLS, encryption at rest and in transit, logging, access management, and documented procedures, but I'm specifically unsure about the network design. Should I place the Lambda functions in a VPC with private connectivity to AWS services such as DynamoDB, or is it technically and auditorily defensible to leave Lambda outside a VPC when using managed services?
3 Answers
For some organizations, especially large healthcare customers, a VPC makes security reviews easier because they expect to see security groups, private endpoints, and explicit network controls. Reviewers may also ask for firewall or endpoint-detection controls that do not map neatly to Lambda. That is an approval and governance concern, though—not proof that Lambda outside a VPC is inherently unsafe. In some cases teams choose ECS on Fargate simply because it fits the customer's checklist better.
There usually isn't much technical benefit to putting Lambda in a VPC for this architecture, but there may be an audit and customer-approval benefit. A VPC is not what makes the application HIPAA compliant; your covered services, agreements, IAM policies, encryption, logging, monitoring, incident response, and documented controls matter more. If you do use a VPC, remember that you also inherit responsibility for routing, endpoints, NAT, security groups, and maintaining that network configuration.
A Lambda function configured for VPC access is not literally running inside your AWS account's VPC. Lambda creates managed Hyperplane network interfaces that bridge the function to your VPC. Also, AWS service traffic from AWS-hosted compute generally stays on AWS's network even when public service endpoints are used. VPC endpoints can still be useful for enforcing private access and producing a clearer network-control story, but they are not automatically required for HIPAA.
That makes sense. I was mostly wondering whether the VPC itself was required rather than just something that might make the review easier.