I want to connect an AWS Lambda function to resources that are located in a dedicated AWS virtual private cloud (VPC).

Because AWS Lambda does not currently support running in dedicated tenancy VPCs, you must peer the dedicated VPC to a regular VPC that contains your Lambda function.

This article assumes you have a basic understanding of NodeJS and AWS Command Line Interface (CLI).

 

Create a NodeJS Lambda deployment package

In your local environment, create a NodeJS Lambda deployment package that includes the net-ping module. This sample source code uses a JS implementation of ping to verify a response in order to test connectivity to an EC2 instance in a dedicated tenancy VPC:

var ping = require('ping-net');

 

 

exports.handler = function(event, context){

    var targetIp = event.target_ip;

    var targetPort = event.target_port;

 

 

    ping.ping({ address: targetIp, port:targetPort}, function(data) {

        console.log(data);

        context.succeed();

    });

};

Configuring the VPCs

1. Note: If you have already set up a default tenancy VPC, then you can skip this step.
In the Amazon VPC console, create a default tenancy VPC with a 10.0.0.0/16 CIDR block and a dedicated tenancy VPC with a 11.0.0.0/16 CIDR block. If you are using a different CIDR block, ensure that the default and dedicated VPCs have different, non-overlapping, blocks

2. On the navigation pane, choose Peering Connections.

3. Choose Create VPC Peering Connection.

4. Enter the name of your dedicated tenancy VPC in the Name tag field and the VPC ID for the default tenancy VPC in the Local VPC to peer field. Select the My account radio button, enter the VPC ID for the dedicated tenancy VPC in the VPC field, and then choose Create VPC Peering Connection.

5. Each VPC will have a route table assigned to it. Before any communication can occur between the two, the route tables must be configured this way:

Dedicated tenancy VPC:

Destination

Target

Status

Propagated

 

12.0.0.0/16

local  

Active

No

 

11.0.0.0/16

<pcx-aaaabbbb>

Active

No

 

Peering tenancy VPC:

Destination

Target

Status

Propagated

 

11.0.0.0/16  

local  

Active

No

 

12.0.0.0/16  

<pcx-aaaabbbb>

Active

No

 

1. Create a new Lambda function in the same region as the default tenancy VPC.

Be sure to choose the lambda_basic_vpc_execution role. If it doesn't exist, choose Create New Role and then enter the following policy:

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Effect": "Allow",

            "Action": [

                "logs:CreateLogGroup",

                "logs:CreateLogStream",

                "logs:PutLogEvents"

            ],

            "Resource": "arn:aws:logs:*:*:*"

        },

        {

            "Effect": "Allow",

            "Action": [

                "ec2:CreateNetworkInterface",

                "ec2:DescribeNetworkInterfaces",

                "ec2:DetachNetworkInterface",

                "ec2:DeleteNetworkInterface"

            ],

            "Resource": "*"

        }

    ]

}

2. For VPC configuration, choose default tenancy VPC.

3. Choose Create.

Test connectivity

1. Start an EC2 instance in your dedicated VPC if there is not one already running.

2. Verify that both VPC subnet ACLs allow traffic on the port that you are testing, and also for the EC2 instance's security group.

3. Because the NodeJS ping utility requires a port number as well as an IP address, verify that a service is running on the EC2 instance that the Lambda function can ping.&nbsp; This can be verified by installing a lightweight web server on the instance—for example, lighttpd. The default port is 80.

sudo yum install lighttpd

sudo service lighttpd start

4. Configure the test event.

Event Example:

{

    "target_ip": ,

    "target_port": 80

}

5. To verify that the connection was successful, check for output similar to the following:

[ { address: ,

port: 80,

attempts: 10,

avg: 8.156777100000003,

max: 39.088728,

min: 1.144363,

results:

      [ [Object],

        [Object],

        [Object],

        [Object],

        [Object],

        [Object],

        [Object],

        [Object],

        [Object],

        [Object] ] } ]

 

Because the function output is showing non-nil values for average, max, and min latency, this shows that your VPC peering connection has been set up successfully.

Lambda, VPC, EC2, Linux


Did this page help you? Yes | No

Back to the AWS Support Knowledge Center

Need help? Visit the AWS Support Center

Published: 2016-08-22