How can my Lambda function in a VPC access Systems Manager Parameter Store?
Last updated: 2019-08-05
I have an AWS Lambda function in an Amazon virtual private cloud (Amazon VPC). I want to connect to AWS Systems Manager and access Parameter Store, but I can't. Why can't I access Parameter Store?
By default, Lambda has internet access and can access Systems Manager and Parameter Store without additional setup. However, by default a Lambda function in an Amazon VPC doesn't have internet access to access Parameter Store values.
Tip: Don't put your Lambda function in an Amazon VPC unless you need it to access other resources in the VPC. For more information, see Lambda VPC in Best Practices for Working with AWS Lambda Functions.
Do either of the following:
Give internet access to your Lambda function
With internet access, your Lambda function in an Amazon VPC can access Parameter Store as expected. For instructions, see How do I give internet access to my Lambda function in a VPC?
Use an interface endpoint in your VPC
Without internet access, your Lambda function in an Amazon VPC can still access Parameter Store through an interface endpoint. Create an interface endpoint for Systems Manager. Then, your Lambda function can access Parameter Store as expected.
Note: AWS PrivateLink VPC endpoints rely on DNS. If you use AWS PrivateLink, make sure that you configure the DHCP options for your Amazon VPC so that DNS is set up for it. For more information, see Using DNS with Your VPC.