CodePark/ questions / VPC, subnets & security groups
START PRACTICINGPRACTICE
Backend question · Cloud & AWS › VPC, subnets & security groups

You attach a Lambda function to your VPC so it can reach RDS. Now its calls to a third-party HTTPS API and to DynamoDB time out. Putting it in a public subnet does not help. Why?

A Lambda function attached to a VPC loses its default internet access. It now sends traffic through ENIs (Elastic Network Interfaces: virtual network cards) in the subnets you choose. These ENIs have only private IPs.

An internet gateway only works for resources with a public IP. So in a public subnet, a private-only ENI still cannot reach the internet. That is why moving the function to a public subnet does not help.

The fix:

  • Put the function in private subnets. Their route table should send 0.0.0.0/0 (all internet traffic) to a NAT gateway in a public subnet.
  • For AWS services, add VPC endpoints instead. Use a gateway endpoint for DynamoDB or S3. Use interface endpoints for services like Secrets Manager or SQS. Endpoints avoid NAT costs and keep traffic private.

Also check that the function's security group allows the outbound traffic. By default, security groups allow all outbound traffic.

  • A VPC-attached Lambda uses ENIs that have only private IPs.
  • A public subnet does not help without a public IP.
  • Use private subnets with a route to a NAT gateway.
  • Use VPC endpoints for AWS services like DynamoDB, S3 and Secrets Manager.
  • Check the security group's outbound rules.