Securing Lambda inside private subnets