# WebFunctionCodeCopyOptions

Configuration for the Lambda function that copies staged code into its destination bucket.

The function is a stack-level singleton: every copy whose options resolve to the same
configuration shares one function. Supplying different options produces a separate
function, since a single Lambda cannot hold two conflicting configurations.

- Source: [`aws-lambda/lib/webfunction-code.ts`](https://github.com/aws/aws-cdk/blob/v2.276.0/packages/aws-cdk-lib/aws-lambda/lib/webfunction-code.ts#L234)
- Type last changed: v2.276.0 · 10 Nov 2026

## Example

```ts
import * as ec2 from 'aws-cdk-lib/aws-ec2';

declare const vpc: ec2.IVpc;

lambda.WebFunctionCode.fromAssetToManagedBucket(path.join(__dirname, 'my-app'), {
  copyOptions: {
    vpc,
    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
  },
});
```

## Properties

- `logGroup`: [ILogGroupRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_logs.ILogGroupRef.html) — The log group the Lambda function sends logs to.

  **Default:** a log group is created in the stack, shared by every copy that uses the same function

- `role`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — Execution role for the Lambda function that performs the copy.

  **Default:** a role is created with permissions to read the source object and write the destination object

- `securityGroups`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html)[] — Security groups for the Lambda function.

  **Default:** a dedicated security group is created

  Only used if `vpc` is supplied.

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) — The VPC to run the Lambda function in.

  **Default:** the function is not placed in a VPC

  Only needed if your organization requires all functions to run inside a VPC. The function
  calls S3, so the VPC needs either a NAT gateway or an S3 VPC endpoint.

- `vpcSubnets`: [SubnetSelection](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetSelection.html) — Which subnets to place the Lambda function in.

  **Default:** the VPC's private subnets

  Only used if `vpc` is supplied.