how to put the lambda in VPC by CloudFormation template

I am developping lambda with CloudFormation by SAM

My template.yaml is here.

It can be deployed, however this lambda is not set in VPC.

I want to put the lambda in default VPC (to access RDS)

Any setting can be used here or I should do something another??

(And, template makes IAmRole automatically, is there any way I can attach policy to it?? for example RDSFullAccess)

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  python3.9   Sample SAM Template for chatbot-sam

Parameters:
  DBNAME:
    Type: String
  DBUSER:
    Type: String
  DBPASSWORD:
    Type: String
  DBHOST:
    Type: String
  DBPORT:
    Type: String
  LINELONGLIVETOKEN:
    Type: String
Globals:
  Function:
    Timeout: 30
    Environment:
      Variables:
        DBNAME: !Ref DBNAME
        DBUSER: !Ref DBUSER
        DBPASSWORD: !Ref DBPASSWORD
        DBHOST: !Ref DBHOST
        DBPORT: !Ref DBPORT  
        LINELONGLIVETOKEN: !Ref LINELONGLIVETOKEN  
Resources:
  WebhookFunction:
    Type: AWS::Serverless::Function 
    Properties:
      PackageType: Image
      Architectures:
        - x86_64
      Events:
        Webhook:
          Type: Api 
          Properties:
            Path: /webhook
            Method: post
    Metadata:
      Dockerfile: Dockerfile.webhook
      DockerContext: ./chatbotapp
      DockerTag: python3.9-v1




Outputs:
  WebhookApi:
    Description: "API Gateway endpoint URL for Prod stage for Hello World function"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/webhook/"
  WebhookFunction:
    Description: "Webhook Lambda Function ARN"
    Value: !GetAtt WebhookFunction.Arn
  WebhookFunctionIamRole:
    Description: "Implicit IAM Role created for Webhook function"
    Value: !GetAtt WebhookFunctionRole.Arn

I updated.

Attaches VpcConfig and Policies , however it doesn't look change.

lambda -> setting -> vpc, there is no vpc setting and can't find the clue it belongs to SecurityGroup and Subnet

  Policies: AWSLambdaVPCAccessExecutionRole
  VpcConfig:
    SubnetIds:
      - subnet-fb6fa4d0
      - subnet-bf8ab8e4
    SecurityGroupIds:
      - sg-0641506b4ec3782de


AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  python3.9   Sample SAM Template for chatbot-sam

Parameters:
  DBNAME:
    Type: String
  DBUSER:
    Type: String
  DBPASSWORD:
    Type: String
  DBHOST:
    Type: String
  DBPORT:
    Type: String
  LINELONGLIVETOKEN:
    Type: String
Globals:
  Function:
    Timeout: 30
    Environment:
      Variables:
        DBNAME: !Ref DBNAME
        DBUSER: !Ref DBUSER
        DBPASSWORD: !Ref DBPASSWORD
        DBHOST: !Ref DBHOST
        DBPORT: !Ref DBPORT  
        LINELONGLIVETOKEN: !Ref LINELONGLIVETOKEN  
Resources:
  WebhookFunction:
    Type: AWS::Serverless::Function 
    Properties:
      PackageType: Image
      Architectures:
        - x86_64
      Events:
        Webhook:
          Type: Api 
          Properties:
            Path: /webhook
            Method: post
      Policies: AWSLambdaVPCAccessExecutionRole
      VpcConfig:
        SubnetIds:
          - subnet-fb6fa4d0
          - subnet-bf8ab8e4
        SecurityGroupIds:
          - sg-0641506b4ec3782de
    Metadata:
      Dockerfile: Dockerfile.webhook
      DockerContext: ./chatbotapp
      DockerTag: python3.9-v1




Outputs:
  WebhookApi:
    Description: "API Gateway endpoint URL for Prod stage for Hello World function"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/webhook/"
  WebhookFunction:
    Description: "Webhook Lambda Function ARN"
    Value: !GetAtt WebhookFunction.Arn
  WebhookFunctionIamRole:
    Description: "Implicit IAM Role created for Webhook function"
    Value: !GetAtt WebhookFunctionRole.Arn

You'll need to add a VpcConfig to the properties of your function definition. You can see an example of how to use that here.

You can also add policies to the default role that is made for the function, or you can supply your own role, in which case the default role will not be created.