Secure network connections to on-premises networks in serverless applications

1 . A serverless code execution system comprising:

one or more computing devices implementing serverless code execution functions with one or more hardware processors, the one or more computing devices configured to:

receive a connection configuration for a serverless function, wherein the connection configuration specifies a connection requirement for an on-premises environment external to the serverless code execution system;

obtain an invocation of the serverless function in the serverless code execution system;

select a worker computing device within the serverless code execution system on which to execute a serverless instance of the serverless function; and

distribute, to the worker computing device, instructions to generate a serverless function execution environment in which to execute the serverless instance of the serverless function and instructions to establish, using the specified connection requirement, a secure network connection between the serverless function execution environment and the external on-premises environment; and

the worker computing device, wherein the worker computing device is further configured to:

receive a communication from the serverless function execution environment;

determine a routing of the communication to the external on-premises environment;

route the communication to the external on-premises environment via the secure network connection;

obtain a response to the communication from the external on-premises environment via the secure network connection; and

relay the response to the serverless function execution environment.

2 . The system of claim 1 , wherein, to route the communication to the on-premises environment via the secure network connection, the worker computing device is configured to:

encapsulate the communication in accordance with the determined routing; and

route the encapsulated communication to the on-premises environment via the secure network connection.

3 . The system of claim 1 , wherein the worker computing device is further configured to generate, outside of the function execution environment, the secure network connection to the on-premises environment, and wherein to generate the secure network connection to the on-premises environment, the worker computing device is configured to:

establish a system-managed virtual private cloud (VPC); and

attach a virtual gateway to the system-managed VPC.

4 . The system of claim 3 , wherein to generate, outside of the function execution environment, a secure network connection to the on-premises environment the worker computing devices is configured to establish an endpoint of the secure network connection in an offload card, wherein the offload card is a separate computing device communicatively coupled to a server hosting the worker computing device.

5 . The system of claim 3 , wherein to generate, outside of the function execution environment, a secure network connection to the on-premises environment, the worker computing device is configured to establish an endpoint of the secure network connection in the worker computing device.

6 . A method for generating a secure network connection between a serverless function execution environment hosted by a serverless computing environment and an external on-premises environment, comprising:

receiving, by the serverless computing environment, a connection configuration including a permission to establish a communication between the serverless function execution environment and the external on-premises environment;

receiving, by the serverless computing environment, an invocation for a serverless function in the serverless function execution environment;

generating the serverless function execution environment in the serverless computing environment to execute an instance of the serverless function;

generating using the received connection configuration, outside of the serverless function execution environment, a secure network connection to the external on-premises environment;

receiving a communication from the serverless function execution environment;

determining a routing of the communication to the external on-premises environment; and

routing the communication from the serverless function execution environment to the external on-premises environment via the secure network connection in accordance with the connection configuration.

7 . The method of claim 6 , wherein generating, outside of the function execution environment, a secure network connection to the external environment comprises:

establishing a system-managed virtual private cloud (VPC); and

attaching a virtual gateway to the system-managed VPC.

8 . The method of claim 6 , wherein the connection configuration comprises a VPN protocol, and wherein generating, outside of the function execution environment, a secure network connection to the external environment comprises establishing, using the VPN protocol, a VPN tunnel from the function execution environment to the external environment through a substrate network, wherein the substrate network represents an overlay network of virtualized computing resources for a cloud provider environment.

9 . The method of claim 6 , wherein the connection configuration comprises access permissions for the external environment.

10 . The method of claim 9 , wherein the communication comprises a request to access specified resources of the external environment.

11 . The method of claim 10 , further comprising analyzing the request to determine that the specified resources are included in the access permissions.

12 . The method of claim 10 , further comprising:

analyzing the request to determine that the specified resources are included in the access permissions; and

closing the secure network connection responsive to the communication.

13 . The method of claim 6 , further comprising routing a responsive communication from the external environment to the function execution environment, wherein routing the responsive communication comprises:

receiving the responsive communication through the secure network connection;

processing the responsive communication to determine a routing to the function execution environment; and

routing the responsive communication to the function execution environment.

14 . The method of claim 13 , wherein processing the responsive communication to determine the routing to the function execution environment comprises:

de-encapsulating the responsive communication;

determining that a destination of the responsive communication is the function execution environment; and

re-encapsulating the responsive communication with header information to facilitate internal routing to the function execution environment.

15 . The method of claim 6 , wherein generating, outside of the function execution environment, a secure network connection to the external environment comprises establishing an endpoint of the secure network connection in a host computing device, wherein the host computing device hosts the function execution environment.

16 . The method of claim 6 , wherein generating, outside of the function execution environment, a secure network connection to the external environment comprises establishing an endpoint of the secure network connection in an offload card, wherein the offload card is a separate computing device communicatively coupled to a server hosting the function execution environment.

17 . One or more non-transitory computer-readable storage media storing instructions that, when executed, cause a computing system to perform operations of serverless code execution functions comprising:

running a secure connection management system in an isolated memory space, wherein the secure connection management system is configured to at least establish a secure network connection between a host computing device for a serverless instance and an external on-premises environment with respect to a serverless execution computing environment hosting the serverless instance;

receiving a connection configuration for the secure network connection with the secure connection management system:

receiving a communication from the serverless instance;

determining a routing of the communication to the external on-premises environment; and

routing the communication to the external on-premises environment through the secure network connection.

18 . The one or more non-transitory computer-readable media of claim 17 , wherein to run a secure connection management system, the one or more non-transitory computer-readable media store further instructions that, when executed, cause the computing system to perform operations comprising:

establishing a system-managed virtual private cloud (VPC);

attaching a virtual gateway to the system-managed VPC; and

establishing the secure network connection using the system-managed VPC and the virtual gateway.

19 . The one or more non-transitory computer-readable media of claim 17 , wherein the one or more non-transitory computer-readable media store further instructions that, when executed, cause a computing system to perform operations further comprising:

relaying a response from the external environment to the serverless instance, wherein relaying the response comprises:

receiving the response through the secure network connection;

processing the response to determine a routing to the serverless instance; and

routing the response to the serverless instance through the secure network connection.

20 . The one or more non-transitory computer-readable media of claim 17 , wherein to route the communication to the external environment through the secure network connection, the one or more non-transitory computer-readable media store further instructions that, when executed, cause the computing system to perform operations comprising:

encapsulating the communication in accordance with the determined routing; and

routing the encapsulated communication to the external environment via the secure network connection.