Experiment goal: Can we use AWS Lambda functions in our private subnets?
const https = require('https');
exports.handler = (event, context, callback) => {
const https = require('https');
https.get('https://encrypted.google.com/', (res) => {
console.log('statusCode:', res.statusCode);
console.log('headers:', res.headers);
res.on('data', (d) => {
process.stdout.write(d);
});
}).on('error', (e) => {
console.log("Error");
console.error(e);
});
};
Lambda function code to check the internet connection (Node js)
aws lambda invoke --function-name vpc-lambda-2 out --log-type Tail --query 'LogResult' --output text --region us-west-1 | base64 -d
A bash command to invoke the Lambda function from an EC2 instance.
First Experiment - Can we invoke a Lambda function in a private subnet from an EC2 instance in a public subnet?
Launches
I deployed an EC2 instance in a public subnet to connect through AWS console.
I deployed a Lambda function inside of the private subnet, with a route table without any internet gateway route specified.
Attaching roles
The EC2 instance has an attached role of
LambdaFullAccess
I attached
AWSLambdaVPCAccessExecutionRole
to the Lambda function, which gives it a permission to manage elastic network interfaces to connect your function to a virtual private cloud (VPC).
Attached policies of the Lambda function.
There is no IGW configured for 0.0.0.0/0 in private subnet.
...and I was able to invoke a Lambda function from an EC2 instance in the different subnet(public), because of
AWSLambdaVPCAccessExecutionRole
that I attached to the Lambda function.And at the same time, I was able to confirm there is no internet access, which is an intended situation.
Lambda function has been fired, but there was no internet connection
Second Experiment - Accessing the internet from the Lambda function
There are two options which are:
- NAT
- VPC Endpoint
1. Using NAT
- I created a NAT attached Elastic IP and associated with the public subnet.
Updated the routing table of the private subnet.
Lambda function successfully reached out the internet.
2. Using VPC Endpoint
...update later
Top comments (0)