Network requests from lambda inside VPC won't work for specific ips

0

Hello,

I have some lambdas running inside a vpc that are connecting to the internet when I set their security group egress rule to allow all outbound traffic but if I change that cidr rule to a specific ip (x.x.x.x/32) instead of all traffic (0.0.0.0/0) and try to make a request to the respective host my requests time out. They are accessing the internet through a nat gateway and public/private subnets. I've tried working the mask backwards all the way down to all traffic but only the all traffic cidr will allow me to successfully make requests.

Any ideas? Thanks

demandé il y a 10 mois248 vues
2 réponses
0

Hello.

Are the IP addresses allowed in the outbound rules of the security group correct?
We would also need to check the protocols that are allowed.

profile picture
EXPERT
répondu il y a 10 mois
  • Evidently not - I turned on flow logs and found the ips that were getting rejected and quickly added them to the outbound rules and that temporarily worked. After a few minutes my requests started to time out again and I'm not sure what caused it - also not sure where I should be finding the ips that were rejected. No host resolving tool returns them..

  • It may depend on what kind of service you are connecting to, but it may have multiple IP addresses.

  • Say I wanted to allow https requests to google.com?

  • If it's google.com it resolves to the multiple IPv4 and IPv6 addresses. You can't expect that it will be always some fixed group of addresses. Some SaaS provide network CIDRs, so you can use them to whitelist, but never heard that Google does it for their google.com site.

0

I would suggest enabling VPC flow logs and see what is being blocked when you use x.x.x.x/32 https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-cwl.html#flow-logs-cwl-create-flow-log

profile pictureAWS
Matt_E
répondu il y a 10 mois

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Instructions pour répondre aux questions