How do I use AWS Systems Manager to troubleshoot internet access issues for an AWS Lambda function that's in an Amazon VPC?

Short description

Verify that the following resources allow outbound internet access to your Lambda function:

• Subnet route tables
• Security groups rules
• Network access control list (network ACL) rules

If any of the preceding resources don't grant internet access to your Lambda function, then reconfigure the resource to grant your function internet access.

To manually review the resources, see How do I give internet access to a Lambda function that's connected to an Amazon VPC? To automate the troubleshooting process, use the AWSSupport-TroubleshootLambdaInternetAccess AWS Systems Manager runbook.

Resolution

To use the AWSSupport-TroubleshootLambdaInternetAccess runbook, complete the following steps:

1. Open the Systems Manager console.
2. In the left navigation pane, under Change Management, choose Automation.
3. Choose Execute automation.
4. Choose the Owned by Amazon tab, and then search for AWSSupport-TroubleshootLambdaInternetAccess.
5. Choose the icon for the AWSSupport-TroubleshootLambdaInternetAccess card.
   Note: Don't choose the name of the automation.
6. Choose Next.
7. (Optional) In the Input parameters section, for AutomationAssumeRole, enter the ARN of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform actions. If an IAM role isn't specified, then Systems Manager Automation uses the permissions of the IAM user role that runs the document. For more information, see Use IAM to configure roles for Automation.
   Important: Either the AutomationAssumeRole or user role must have permissions for the following actions:
   GetFunction
   DescribeRouteTables
   DescribeNatGateways
   DescribeSecurityGroups
   DescribeNetworkAcls
8. For FunctionName, enter the name of the function.
9. For destinationIp, enter the destination IP address where you want to initiate outbound internet access.
10. For destinationPort, enter the destination port where you want to initiate outbound internet access.
11. Choose Execute.

The runbook's output provides the status of each resource that might cause the loss of internet connectivity for your Lambda function. The output also provides recommendations for how to resolve the issue as an "Analysis" message.

Note: For more information about AWS System Manager automation runbooks, see Creating your own runbooks.