(aws-lambda) Build error from DockerImageFunction after upgrading CDK version from 2.92.0 to 2.102.0

[vonmoltke]

I upgraded my CDK package version today from 2.92.0 to 2.102.0. One of the stacks in my application is a Lambda function that is defined with DockerImageFunction. The function deployed fine with 2.92.0; however, with 2.102.0 it throws the following error on build:

Error: Configure 'allowAllOutbound' directly on the supplied SecurityGroups.`
    at DockerImageFunction.configureVpc (/home/fritz/src/data-ingest/deployment/node_modules/aws-cdk-lib/aws-lambda/lib/function.js:1:20312)
    at new Function (/home/fritz/src/data-ingest/deployment/node_modules/aws-cdk-lib/aws-lambda/lib/function.js:1:11323)
    at new DockerImageFunction (/home/fritz/src/data-ingest/deployment/node_modules/aws-cdk-lib/aws-lambda/lib/image-function.js:1:1794)
    ...

I was specifying allowAllOutbound (with a value of true, which is supposed to be the default anyway). If I remove allowAllOutbound from the specification, the error goes away and it appears, from cdk diff at least, that there are no changes to the function. For reference, I am specifying the following optional parameters in the properties:

role
events
environment
allowAllOutbound
timeout
memorySize
reservedConcurrentExecutions
vpc
vpcSubnets
securityGroups
logRetention

I don't know if this new behavior is a bug, an undocumented behavior change, or something that's always been wrong with my configuration but somehow worked until now. Based on where it's coming from I suspect it has something to do with me specifying the networking details, but the documentation doesn't indicate allowAllOutbound is incompatible with anything. What's going on here?

[badaldavda8]

Created a Github Issue here. Facing this too - #28170