How do I give internet access to a Lambda function that's connected to an Amazon VPC?

Short description

Internet access from a private subnet requires network address translation (NAT). To give internet access to an Amazon VPC-connected Lambda function, route its outbound traffic to a NAT gateway or NAT instance in a public subnet. For an example setup, see VPC with servers in private subnets and NAT.

Note: You can also use Amazon VPC endpoints to connect to supported AWS services from within an Amazon VPC without internet access.

Resolution

Create a public subnet and one or more private subnets in your Amazon VPC

Create a subnet for each of your subnets. For the subnet field Name tag, enter a name for each subnet that identifies it as either public or private. For example, you might enter Public subnet, Private lambda 1, and Private lambda 2.

Note: It's a best practice to create more than one private subnet across different Availability Zones. This practice creates redundancy and allows the Lambda service to maintain high availability for your function.

Create an internet gateway and attach it to your Amazon VPC

To create an internet gateway and attach it to your Amazon VPC, see Connect to the internet using an internet gateway.

Create a NAT gateway

Create a NAT gateway. For Subnet, choose the subnet that you want to make public. (Based on the previous example, use Public subnet.)

Note: To test your NAT gateway setup, see Test the public NAT gateway.

Create two custom route tables

Note: When an Amazon VPC-connected Lambda function makes requests, the function randomly selects an associated subnet. If the function uses a misconfigured subnet, then you get an error. To prevent random errors, make sure to use the same configuration for all subnets that your function uses.

Create a custom route table for your public subnet and a second custom route table for your private subnet. When you create route tables, for Name tag, enter a name for each route table to help you identify the subnet that it's associated with. For example, you might use Public subnet and Private Lambda.

For each route table, complete the following steps:

Set up the public subnet's route table

1. Associate the public subnet's route table (Public subnet) with the subnet that you want to make public.
2. Add a new route to the route table that includes the following configurations:
   For Destination, enter 0.0.0.0/0.
   For Target, choose Internet Gateway, and then choose the ID (igw-123example) of the internet gateway that you created.
3. Choose Save routes.

Set up the private subnet's route table

1. Associate the private subnet's route table (Private Lambda) with the private subnets.
2. Add a new route to the route table that includes the following configurations:
   For Destination, enter 0.0.0.0/0.
   For Target, choose NAT Gateway. Then, choose the ID of the NAT gateway (nat-123example) that you created.
   Important: If you use a NAT instance, then choose Network Interface instead.
3. Choose Save routes.

Note: Make sure that the routes to your NAT gateway are in an active status. If the NAT gateway is deleted and you didn't update the routes, then they're in a blackhole status. For more information, see Delete a NAT gateway.

Review your network ACL

The default network access control list (network ACL) in your Amazon VPC allows all inbound and outbound traffic. If you change the network ACL rules, then make sure that you allow outbound requests from your Lambda function.

Also, make sure that your network ACL allows the following inbound traffic based on your VPC configuration:

• For private subnets that use a NAT gateway, allow inbound traffic on ephemeral ports 1024-65535.
• For private subnets that use a NAT instance, allow inbound traffic on the ephemeral ports that your NAT instance operating system uses.

Note: For more information, see Internetwork traffic privacy in Amazon VPC.

Create a Lambda execution role for your VPC

1. Open the AWS Identity and Access Management (IAM) console.
2. In the navigation pane, choose Roles.
3. Choose Create role.
4. On the Create role page, complete the following steps:
   For Select type of trusted entity, choose AWS service.
   For Common use cases, choose Lambda.
   Choose Next: Permissions.
   Under Attach permissions policies, search for AWSLambdaVPCAccessExecutionRole.
   Select the policy with that name. Then, choose Next: Tags.
   (Optional) Add tags for your use case.
   Choose Next: Review.
   For Role name, enter a name for your Lambda execution role. For example: lambda_vpc_basic_execution.
   (Optional) For Role description, enter a description of the role.
5. Choose Create role.

Attach the role to the Lambda function

1. Open the Functions page in the Lambda console.
2. Choose the name of the function that you want to connect to your Amazon VPC.
3. Choose the Configuration tab, and then choose Permissions.
4. In Execution role, choose Edit.
5. Choose the Existing role dropdown list, and then choose your role. For example: lambda_vpc_basic_execution.
6. Choose Save.

For more information, see Lambda execution role and Creating an execution role in the IAM console.

Configure your Lambda function to connect to your Amazon VPC

1. Open the Functions page in the Lambda console.
2. Choose the name of the function that you want to connect to your Amazon VPC.
3. Choose the Configuration tab.
4. Choose VPC from the left navigation bar, and then choose Edit. Then, enter the following fields:
   For Virtual Private Cloud (VPC), choose your VPC.
   For Subnets, select the private subnets that you created. Identify them by their subnet IDs (and names, if you named them).
   For Security groups, choose a security group.
   Note: The default security group allows all outbound internet traffic and is sufficient for most use cases. For more information, see Control traffic to your AWS resources using security groups.
5. Choose Save.

Note: For VPC configured Lambda functions, you can use an egress-only internet gateway to access the internet. For more information, see Turn on outbound IPv6 traffic using an egress-only internet gateway and IPv6 support.

Related information

Giving Lambda functions access to resources in an Amazon VPC

Troubleshoot networking issues in Lambda

How do I troubleshoot Lambda function failures?