AWS lambda VPC cannot reach internet with IG attached

0
votes

I have an AWS lambda function that makes a request to the internet. When it makes the request with NO VPC, it's ok, but when I add it to the VPC, it stops working. I've attached an Internet Gateway to the VPC and created a NAT Gateway with RT to use outbound 0.0.0.0/0, but it stills not working. With the 15seconds timeout, it's always throwing TO.

Could you please help me?

I've already followed these sites:

Everything seems to be well configured.

Lambda configuration

Route Table configuration

IGW attached to VPC

2
amazon-web-servicesaws-lambdavpnvpc
Did you follow steps mentioned in AWS documentation? - aws.amazon.com/premiumsupport/knowledge-center/… - CuriousMind
Yes. I've followed every step. I've tried with private subnet with NAT attached and also with public subnet with IGW attached. - Nahuel
I've created a dummy lambda function to request HTTP google.com, with NO VPC, it works. With the VPC it doesn't work. - Nahuel
You should be able to test your Lambda function from the aws lambda console test. And verify what log messages are produced. Adding Lambda to the VPC would require AWSLambdaVPCAccessExecutionRole - srikanth Nutigattu
Same problem, AWS it's so bureaucratic :( - Ragen Dazs

2 Answers

2
votes

There are three ways to grant Internet access to an AWS Lambda function:

  • Do not assign it a VPC, or
  • Assign it to a VPC and attach an Elastic IP Address to the ENI (Elastic Network Interface) that is created in the VPC, or
  • Assign it to a private subnet in a VPC and use a NAT Gateway to grant the private subnet access to the Internet
0
votes

If you have already verified the network configurtions like VPC setup, Subnets, Route Table, IG/NAG gate way. And associated the Lambda with current subnet and security groups.

Then the last thing to verify would be:

For Lambda functions to work into custom or User Defined VPC, Adding Lambda to the VPC would require AWSLambdaVPCAccessExecutionRole in addition to AWSLambdaBasicExecutionRole.

Ensure that the associated role has the above permissions.

Source: https://docs.aws.amazon.com/lambda/latest/dg/vpc-rds-create-iam-role.html