From 828efd4e3b18e0b56324b624ca2d00e010527a3c Mon Sep 17 00:00:00 2001
From: BenjaminBurgalat <b.burgalat@betclicgroup.com>
Date: Tue, 21 Jul 2026 14:11:30 +0200
Subject: [PATCH 1/2] Allow function-level `vpc: false`/`null` under strict
 config validation

Function VPC opt-out (`vpc: false` or `vpc: null`) is honored by the compile
step (lib/plugins/aws/package/compile/functions.js), but the JSON schema only
accepted an object. With v4's default `configValidationMode: error`, this was
rejected with `vpc: must be object`, making it impossible to exclude a single
function from `provider.vpc` under strict validation.

Extend the function-level `vpc` schema to accept `false`/`null` in addition to
the config object, matching the compile logic. Add a regression test asserting
`vpc: false` yields no VpcConfig.
---
 lib/plugins/aws/provider.js                           | 11 ++++++++++-
 .../lib/plugins/aws/package/compile/functions.test.js | 10 ++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/lib/plugins/aws/provider.js b/lib/plugins/aws/provider.js
index 62240f097..cd9efebe8 100644
--- a/lib/plugins/aws/provider.js
+++ b/lib/plugins/aws/provider.js
@@ -1522,7 +1522,16 @@ class AwsProvider {
               ],
             },
             versionFunction: { $ref: '#/definitions/awsLambdaVersioning' },
-            vpc: { $ref: '#/definitions/awsLambdaVpcConfig' },
+            vpc: {
+              // `false`/`null` opt a function out of `provider.vpc`; the compile
+              // step (package/compile/functions.js) handles both, so the schema
+              // must accept them too (otherwise strict validation rejects them).
+              anyOf: [
+                { $ref: '#/definitions/awsLambdaVpcConfig' },
+                { const: false },
+                { type: 'null' },
+              ],
+            },
             httpApi: {
               type: 'object',
               properties: {
diff --git a/test/unit/lib/plugins/aws/package/compile/functions.test.js b/test/unit/lib/plugins/aws/package/compile/functions.test.js
index f95c767d1..e57bde78f 100644
--- a/test/unit/lib/plugins/aws/package/compile/functions.test.js
+++ b/test/unit/lib/plugins/aws/package/compile/functions.test.js
@@ -2588,6 +2588,10 @@ describe('lib/plugins/aws/package/compile/functions/index.test.js', () => {
               vpc: null,
               handler: 'index.handler',
             },
+            vpcDisabled: {
+              vpc: false,
+              handler: 'index.handler',
+            },
           },
         },
       });
@@ -2639,6 +2643,12 @@ describe('lib/plugins/aws/package/compile/functions/index.test.js', () => {
       expect(Properties.VpcConfig).to.be.undefined;
     });
 
+    it('should allow `functions[].vpc` set to `false` to opt out of `provider.vpc`', () => {
+      const Properties = cfResources[naming.getLambdaLogicalId('vpcDisabled')].Properties;
+
+      expect(Properties.VpcConfig).to.be.undefined;
+    });
+
     it('should support `provider.tags`', () => {
       const providerConfig = serviceConfig.provider;
 

From d7124bb56957bde53d7a8a11265179339644ec92 Mon Sep 17 00:00:00 2001
From: BenjaminBurgalat <b.burgalat@betclicgroup.com>
Date: Tue, 21 Jul 2026 16:07:53 +0200
Subject: [PATCH 2/2] Clarify function-level vpc schema comment

Reword the comment on the function `vpc` schema to make clear the change is
on the function-level field (opting a function out of the provider VPC), not
on `provider.vpc` itself.
---
 lib/plugins/aws/provider.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/plugins/aws/provider.js b/lib/plugins/aws/provider.js
index cd9efebe8..c1292843d 100644
--- a/lib/plugins/aws/provider.js
+++ b/lib/plugins/aws/provider.js
@@ -1523,9 +1523,10 @@ class AwsProvider {
             },
             versionFunction: { $ref: '#/definitions/awsLambdaVersioning' },
             vpc: {
-              // `false`/`null` opt a function out of `provider.vpc`; the compile
-              // step (package/compile/functions.js) handles both, so the schema
-              // must accept them too (otherwise strict validation rejects them).
+              // Function-level opt-out: `false`/`null` exclude this function from
+              // the provider VPC. The compile step (package/compile/functions.js)
+              // already handles both, so this function-level schema must accept
+              // them too, otherwise strict validation rejects a valid opt-out.
               anyOf: [
                 { $ref: '#/definitions/awsLambdaVpcConfig' },
                 { const: false },