Accessing Parameter Store from VPC / Lambda

Question

My lambda function can access Systems Manager parameters (ssm.getParameter) when NOT in a VPC. When I add the lambda function to my VPC, I lose access to SSM. The function times out.

Clearly I am missing a security group setting or something but can't figure it out. What do I need to do to enable lambda access to SSM when running it in my VPC?

Answer 1

Most likely this is because you're creating your lambda function in the public subnet, Lambda does get public ip address and uses NAT to access resources outside VPC.

Also, as a side note AWS now provides an endpoint for SSM https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-setting-up-vpc.html so you don't even need to go through the internet anymore