fix(lambda): never send a half-configured VPC attachment

Clearing only one of the two VPC lists produced `VpcConfig: { SubnetIds: [] }`
with no security groups, because an empty array is truthy and the wrapper
included each list independently. That is not a detach — it is an invalid
partial attachment.

A Lambda VPC attachment is a unit, so the contract now requires the two lists
to be supplied together on Create Function and Update Function Configuration,
naming the missing side. The wrapper defaults the other list to empty as well,
so it cannot emit a one-sided config even if called directly.

Author: waleedlatif1

apps/sim/lib/api/contracts/tools/aws/lambda-create-function.ts

@@ -96,6 +96,16 @@ const CreateFunctionSchema = z
         })
       }
     }
+    const hasSubnets = value.vpcSubnetIds !== undefined
+    const hasSecurityGroups = value.vpcSecurityGroupIds !== undefined
+    if (hasSubnets !== hasSecurityGroups) {
+      ctx.addIssue({
+        code: 'custom',
+        path: [hasSubnets ? 'vpcSecurityGroupIds' : 'vpcSubnetIds'],
+        message:
+          'vpcSubnetIds and vpcSecurityGroupIds must be supplied together: send both lists to attach a VPC, or both empty to detach',
+      })
+    }
   })
 
 const CreateFunctionResponseSchema = z.object({

apps/sim/lib/api/contracts/tools/aws/lambda-update-function-configuration.ts

@@ -10,31 +10,44 @@ import type {
 } from '@/lib/api/contracts/types'
 import { defineRouteContract } from '@/lib/api/contracts/types'
 
-const UpdateFunctionConfigurationSchema = z.object({
-  ...lambdaConnectionFields,
-  functionName: z
-    .string()
-    .min(1, 'functionName is required')
-    .max(256, 'functionName cannot exceed 256 characters'),
-  role: z.string().optional(),
-  runtime: z.string().optional(),
-  handler: z.string().optional(),
-  description: z.string().optional(),
-  functionTimeout: z.number().int().min(1).max(900).optional(),
-  memorySize: z.number().int().min(128).max(32768).optional(),
-  ephemeralStorageSize: z.number().int().min(512).max(10240).optional(),
-  environment: z.record(z.string(), z.string()).optional(),
-  layers: z.array(z.string()).optional(),
-  vpcSubnetIds: z.array(z.string()).optional(),
-  vpcSecurityGroupIds: z.array(z.string()).optional(),
-  tracingMode: z.enum(['Active', 'PassThrough']).optional(),
-  deadLetterTargetArn: z.string().optional(),
-  kmsKeyArn: z.string().optional(),
-  snapStartApplyOn: z.enum(['PublishedVersions', 'None']).optional(),
-  logFormat: z.enum(['JSON', 'Text']).optional(),
-  logGroup: z.string().optional(),
-  revisionId: z.string().optional(),
-})
+const UpdateFunctionConfigurationSchema = z
+  .object({
+    ...lambdaConnectionFields,
+    functionName: z
+      .string()
+      .min(1, 'functionName is required')
+      .max(256, 'functionName cannot exceed 256 characters'),
+    role: z.string().optional(),
+    runtime: z.string().optional(),
+    handler: z.string().optional(),
+    description: z.string().optional(),
+    functionTimeout: z.number().int().min(1).max(900).optional(),
+    memorySize: z.number().int().min(128).max(32768).optional(),
+    ephemeralStorageSize: z.number().int().min(512).max(10240).optional(),
+    environment: z.record(z.string(), z.string()).optional(),
+    layers: z.array(z.string()).optional(),
+    vpcSubnetIds: z.array(z.string()).optional(),
+    vpcSecurityGroupIds: z.array(z.string()).optional(),
+    tracingMode: z.enum(['Active', 'PassThrough']).optional(),
+    deadLetterTargetArn: z.string().optional(),
+    kmsKeyArn: z.string().optional(),
+    snapStartApplyOn: z.enum(['PublishedVersions', 'None']).optional(),
+    logFormat: z.enum(['JSON', 'Text']).optional(),
+    logGroup: z.string().optional(),
+    revisionId: z.string().optional(),
+  })
+  .superRefine((value, ctx) => {
+    const hasSubnets = value.vpcSubnetIds !== undefined
+    const hasSecurityGroups = value.vpcSecurityGroupIds !== undefined
+    if (hasSubnets !== hasSecurityGroups) {
+      ctx.addIssue({
+        code: 'custom',
+        path: [hasSubnets ? 'vpcSecurityGroupIds' : 'vpcSubnetIds'],
+        message:
+          'vpcSubnetIds and vpcSecurityGroupIds must be supplied together: send both lists to attach a VPC, or both empty to detach',
+      })
+    }
+  })
 
 const UpdateFunctionConfigurationResponseSchema = z.object({
   success: z.literal(true),

apps/sim/lib/internal/lambda/execute-tool.test.ts

@@ -407,6 +407,40 @@ describe('executeLambdaTool', () => {
     expect(mockOperations.executeLambdaInvoke).not.toHaveBeenCalled()
   })
 
+  it('rejects a one-sided VPC change that would half-detach the function', async () => {
+    const response = await executeLambdaTool(
+      createRequest({
+        toolId: 'lambda_update_function_configuration',
+        input: { ...CONNECTION, functionName: 'alpha', vpcSubnetIds: [] },
+      })
+    )
+
+    expect(response.status).toBe(400)
+    expect(JSON.stringify(await response.json())).toContain('must be supplied together')
+    expect(mockOperations.executeLambdaUpdateFunctionConfiguration).not.toHaveBeenCalled()
+  })
+
+  it('accepts a full VPC detach when both lists are cleared', async () => {
+    mockOperations.executeLambdaUpdateFunctionConfiguration.mockResolvedValue({
+      success: true,
+      output: {},
+    })
+
+    const response = await executeLambdaTool(
+      createRequest({
+        toolId: 'lambda_update_function_configuration',
+        input: {
+          ...CONNECTION,
+          functionName: 'alpha',
+          vpcSubnetIds: [],
+          vpcSecurityGroupIds: [],
+        },
+      })
+    )
+
+    expect(response.status).toBe(200)
+  })
+
   it('rejects create_function with a Zip package but no runtime or handler', async () => {
     const response = await executeLambdaTool(
       createRequest({

apps/sim/lib/internal/lambda/operations.test.ts

@@ -313,7 +313,7 @@ describe('Lambda operations', () => {
       expect(input.LoggingConfig).toBeUndefined()
     })
 
-    it('builds a VPC config from a subnet list alone', async () => {
+    it('never emits a half-configured VPC attachment', async () => {
       mocks.send.mockResolvedValue({ FunctionName: 'alpha' })
 
       await executeLambdaCreateFunction({
@@ -323,7 +323,23 @@ describe('Lambda operations', () => {
         vpcSubnetIds: ['subnet-1'],
       })
 
-      expect(sentInput().VpcConfig).toEqual({ SubnetIds: ['subnet-1'] })
+      expect(sentInput().VpcConfig).toEqual({
+        SubnetIds: ['subnet-1'],
+        SecurityGroupIds: [],
+      })
+    })
+
+    it('sends both lists empty when only one side is cleared', async () => {
+      mocks.send.mockResolvedValue({ FunctionName: 'alpha' })
+
+      await executeLambdaCreateFunction({
+        ...CONNECTION,
+        functionName: 'alpha',
+        role: 'arn:aws:iam::1:role/exec',
+        vpcSubnetIds: [],
+      })
+
+      expect(sentInput().VpcConfig).toEqual({ SubnetIds: [], SecurityGroupIds: [] })
     })
   })
 

apps/sim/lib/internal/lambda/operations.ts

@@ -167,12 +167,17 @@ function toCors(input: {
   return Object.keys(cors).length > 0 ? cors : undefined
 }
 
-/** Builds the SDK `VpcConfig` wrapper, omitted entirely when neither list was supplied. */
+/**
+ * Builds the SDK `VpcConfig` wrapper, omitted entirely when neither list was supplied.
+ * A Lambda VPC attachment is a unit, so both lists are always sent together — emitting only
+ * one of them would leave a half-configured attachment. The contract already rejects a
+ * one-sided request; the defaults here keep that guarantee if it is ever called directly.
+ */
 function toVpcConfig(subnetIds?: string[], securityGroupIds?: string[]) {
   if (!subnetIds && !securityGroupIds) return undefined
   return {
-    ...(subnetIds ? { SubnetIds: subnetIds } : {}),
-    ...(securityGroupIds ? { SecurityGroupIds: securityGroupIds } : {}),
+    SubnetIds: subnetIds ?? [],
+    SecurityGroupIds: securityGroupIds ?? [],
   }
 }