CloudFormation template to create resources necessary to run a Lambda function with a static public IP

LambdaPublicIP.yaml

####
# Based on https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html
# and https://github.com/awsdocs/aws-lambda-developer-guide/blob/master/templates/vpc-privatepublic.yaml
####

pubPrivateVPC:
  Type: AWS::EC2::VPC
  Properties:
    CidrBlock: 172.31.0.0/16
    Tags:
      - Key: Name
        Value: 
          Ref: AWS::StackName
publicSubnet1:
  Type: AWS::EC2::Subnet
  Properties:
    VpcId: 
      Ref: pubPrivateVPC
    AvailabilityZone:
      Fn::Select:
        - 0
        - Fn::GetAZs: ""
    CidrBlock: 172.31.0.0/24
    MapPublicIpOnLaunch: true
privateSubnet1:
  Type: AWS::EC2::Subnet
  Properties:
    VpcId: 
      Ref: pubPrivateVPC
    AvailabilityZone:
      Fn::Select:
        - 0
        - Fn::GetAZs: ""
    CidrBlock: 172.31.3.0/24
    MapPublicIpOnLaunch: false
privateSubnet2:
  Type: AWS::EC2::Subnet
  Properties:
    VpcId: 
      Ref: pubPrivateVPC
    AvailabilityZone:
      Fn::Select:
        - 1
        - Fn::GetAZs: ""
    CidrBlock: 172.31.2.0/24
    MapPublicIpOnLaunch: false
internetGateway:
  Type: AWS::EC2::InternetGateway
gatewayToInternet:
  Type: AWS::EC2::VPCGatewayAttachment
  Properties:
    VpcId: 
      Ref: pubPrivateVPC
    InternetGatewayId: 
      Ref: internetGateway
publicRouteTable:
  Type: AWS::EC2::RouteTable
  Properties:
    VpcId: 
      Ref: pubPrivateVPC
publicRoute:
  Type: AWS::EC2::Route
  DependsOn: gatewayToInternet
  Properties:
    RouteTableId: 
      Ref: publicRouteTable
    DestinationCidrBlock: 0.0.0.0/0
    GatewayId: 
      Ref: internetGateway
publicSubnet1RouteTableAssociation:
  Type: AWS::EC2::SubnetRouteTableAssociation
  Properties:
    SubnetId: 
      Ref: publicSubnet1
    RouteTableId: 
      Ref: publicRouteTable
natGateway:
  Type: AWS::EC2::NatGateway
  DependsOn: natPublicIP
  Properties:
    AllocationId: 
      Fn::GetAtt: [ natPublicIP, AllocationId ]
    SubnetId: 
      Ref: publicSubnet1
natPublicIP:
  Type: AWS::EC2::EIP
  DependsOn: pubPrivateVPC
  Properties:
    Domain: vpc
privateRouteTable:
  Type: AWS::EC2::RouteTable
  Properties:
    VpcId: 
      Ref: pubPrivateVPC
privateRoute:
  Type: AWS::EC2::Route
  Properties:
    RouteTableId: 
      Ref: privateRouteTable
    DestinationCidrBlock: 0.0.0.0/0
    NatGatewayId: 
      Ref: natGateway
privateSubnet1RouteTableAssociation:
  Type: AWS::EC2::SubnetRouteTableAssociation
  Properties:
    SubnetId: 
      Ref: privateSubnet1
    RouteTableId: 
      Ref: privateRouteTable
privateSubnet2RouteTableAssociation:
  Type: AWS::EC2::SubnetRouteTableAssociation
  Properties:
    SubnetId: 
      Ref: privateSubnet2
    RouteTableId: 
      Ref: privateRouteTable

Can be used as follows:

  Resources:
    'Fn::Transform':
      Name: 'AWS::Include'
      Parameters:
        Location: s3://almadtest/sam/LambdaPublicIP.yaml

Requires this policy in the Lambda execution role:

        - PolicyName: ec2vpcaccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - ec2:CreateNetworkInterface
              - ec2:DescribeNetworkInterfaces
              - ec2:DeleteNetworkInterface
              Resource: "*"          

To get the IP address in the output:

    PublicID:
      Description: Public IP for Nat Gateway
      Value: !Ref natPublicIP
      Export: 
        Name: !Join ["-", [!Ref "AWS::StackName","eip"]]