AWS Lambda Support
Fixing Lambda functions in a VPC that cannot reach the internet.
When you attach a Lambda function to a VPC, it loses its default internet path. Calls to public APIs or AWS services then hang until the timeout. Putting the function in a public subnet does not fix this. We build the right path with NAT or VPC endpoints and prove it works.
When You Need This
The situations where this work pays for itself.
Signs it is time
- A function stopped reaching an API or AWS service right after you added VPC settings
- SDK calls to Secrets Manager, SQS or STS hang then time out
- A function needs both a private database and a public API
- You have a NAT gateway bill and want to know which traffic needs it
- Calls work in one Availability Zone but fail in another
What you get
- A diagram of the function's network path with each dependency
- Route table, NAT and endpoint changes as infrastructure as code
- A decision on NAT versus endpoints per dependency with cost reasoning
- A connectivity test you can re-run
How we do it
A clear, safe process you can follow along with.
1. Confirm the symptom
We look for timeouts and connection errors such as ETIMEDOUT or 'Connect timeout on endpoint URL' in the logs, and confirm the function has VPC configuration set. A function without VPC settings has normal internet access.
2. Check which subnets the function uses
A VPC-attached function uses elastic network interfaces in the subnets you chose. Those interfaces have only private IPs, so a route to an internet gateway does not help. We confirm each subnet is private and routes 0.0.0.0/0 to a NAT gateway if internet access is needed.
3. Check the NAT path
The NAT gateway must sit in a public subnet whose route table points to an internet gateway, and every subnet the function uses must have a route to a NAT gateway, ideally in the same Availability Zone.
4. Prefer VPC endpoints for AWS services
For S3 and DynamoDB we add gateway endpoints. For services such as Secrets Manager, SQS, SNS, STS and KMS we add interface endpoints with private DNS enabled. This often removes the need for NAT and cuts data processing charges.
5. Check security groups and DNS
The function's security group needs outbound rules for the destination, and interface endpoint security groups must allow inbound 443 from the function. We confirm DNS resolution and DNS hostnames are enabled on the VPC.
6. Test from inside the VPC
We invoke a test function that resolves and connects to each dependency, and use VPC Reachability Analyzer to prove the path, then remove the test.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Placing the function in a public subnet
Lambda interfaces never receive public IPs, so an internet gateway route gives no internet access. A private subnet with NAT is required.
One NAT gateway for all zones without thought
If that zone fails, functions in other zones lose egress. We weigh resilience against cost deliberately.
Forgetting private DNS on interface endpoints
Without it the SDK still resolves the public service name and the endpoint is never used.
Attaching to a VPC without needing it
Only attach when the function must reach private resources. Otherwise it adds networking to debug for no benefit.
Frequently Asked Questions
Does a Lambda in a VPC lose internet access?
Yes, by default. The function can reach only what its subnets route to, so you need a NAT gateway or VPC endpoints for anything outside the VPC.
Is a NAT gateway or a VPC endpoint cheaper?
It depends on traffic. Gateway endpoints for S3 and DynamoDB are a clear win. Interface endpoints are billed per hour and per GB, so we compare them to NAT charges for your volume.
Can I put Lambda in a public subnet instead?
That does not work for internet access, because the function's network interface has no public IP. Use private subnets with a NAT gateway or endpoints.
Want Help With Fixing Lambda functions in a VPC that cannot reach the internet?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required