Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

AWS lambda function can't reach the internet

I am running a lambda function that I would like to access both a private database server and the internet. I can reach the database just fine, but I am not able to reach the internet.

The setup:

VPC (10.0.0.0/16)
   Public-Subnet (10.0.0.0/24)
      NAT-Security-Group (see security groups below)
         NAT-Server (AMI NAT instance)

   Private-Subnet-1 (10.0.1.0/24) & Private-Subnet-2 (10.0.2.0/24)
      DB-Security-Group (see security groups below)
         DB-Server (RDS PostgreSQL instance)

      Lambda-Security-Group (see security groups below)
         Lambda-Function

The security groups are:

NAT-Security-Group
   Inbound:
      HTTP & HTTPS from source: Lambda-Security-Group
      SSH from 0.0.0.0/0
   Outbound:
      All traffic

DB-Security-Group
   Inbound:
      PostgreSQL from source: Lambda-Security-Group
   Outbound:
      All traffic

Lambda-Security-Group
   Inbound:
      HTTP & HTTPS from source: NAT-Security-Group
   Outbound:
      All traffic

The routing tables for the subnets are:

Public-Subnet:
   10.0.0.0/16 local
   0.0.0.0/0 Internet-Gateway

Private-Subnet-1 & Private-Subnet-2
   10.0.0.0/16 local
   0.0.0.0/0 NAT-Server

I'm at a loss here. Why can't the lambda function reach the internet (connection timeout errors)?

like image 459
Jay Avatar asked Oct 20 '25 14:10

Jay


1 Answers

lambda in public subnet

Since you just need to communicate DB from lambda, place the lambda into public subnet and you don't need to have NAT gateway installed. Anyway there wont be a direct access to the lambda as ELB does and has to be attached to API gateway in case of any access through API endpoint.

lambda in private subnet

  • Add NAT route out into the route table associated with private subnet for all address 0.0.0.0/0
  • Add route out to IGW for all 0.0.0.0/0 into the route table associated with public subnet.
  • Place NAT in public subnet

This should solve the problem of accessing internet from lambda. But is only much useful in case you are going with the DB installed in EC2 for future patch mgmt or any kind of other access from bastion host. If going with RDS there is no point putting lambda in private subnet.

like image 80
Kartik Narayana Maringanti Avatar answered Oct 22 '25 02:10

Kartik Narayana Maringanti



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!