title: How can I setup an AWS lambda to access resources in two, separate VPCs?
body: <p>I'm using Terraform to build an API + corresponding lambda functions.</p>
  
  <p>I have some other infrastructure, which I'd like to think is nicely set up (maybe I'm wrong?):</p>
  
  <ul>
  <li>2 VPCs (let's just call'em <code>test</code> and <code>prod</code>)</li>
  <li>Private &amp; public subnets in each VPC</li>
  <li>RDS DBs launched in the private subnets</li>
  </ul>
  
  <p>All resources are identical on both VPCs; e.g. there's a <code>test-private-subnet</code> and a <code>prod-private-subnet</code> with exactly the same specs, same for DBs, etc.</p>
  
  <p>Now, I'm working on the API and the lambdas that will power said API.</p>
  
  <p>I don't feel like I need a <code>test</code> &amp; <code>prod</code> API gateway and <code>test</code> &amp; <code>prod</code> lambdas: </p>
  
  <ul>
  <li>lambda code will be the same, just acting on different DB</li>
  <li>you can use API <code>stage_variables</code>, with different ips, to achieve a <code>test</code> vs <code>prod</code> environment for the API</li>
  </ul>
  
  <p>But when I try and setup a lambda with the <code>vpc_config</code> block (cause I need it to be associated with the <em>security group</em> that's allowed ingress on the DBs), I get the following error:</p>
  
  <pre><code>Error applying plan:
  
  1 error(s) occurred:
  
  * module.lambdas.aws_lambda_function.api-lambda-users: 1 error(s) occurred:
  
  * aws_lambda_function.api-lambda-users: Error creating Lambda function: InvalidParameterValueException: Security Groups are required to be in the same VPC.
  status code: 400, request id: xxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx
  </code></pre>
  
  <p>My lambda config looks like this:</p>
  
  <pre><code>resource "aws_lambda_function" "api-lambda-users" {
    provider = "PROVIDER"
    function_name    = "users"
    s3_key           = "users/${var.lambda-package-name}"
    s3_bucket        = "${var.api-lambdas-bucket}"
    role             = "${aws_iam_role.lambda-role.arn}"
    handler          = "${var.handler-name}"
    runtime          = "${var.lambda-runtime}"
  
    vpc_config {
      security_group_ids = [
        //"${data.aws_security_group.prod-lambda.id}",
        "${data.aws_security_group.test-lambda.id}"
      ]
      subnet_ids = [
        //"${data.aws_subnet.prod-primary.id}",
        "${data.aws_subnet.test-primary.id}"
      ]
    }
  }
  </code></pre>
  
  <p>Notice I'd ideally like to just specify them, together, in their corresponding lists.</p>
  
  <p>Am I missing something?</p>
  
  <p>Suggestions?</p>
  
  <p>Any help, related or not, is much appreciated.</p>