Network requests from lambda inside VPC won't work for specific ips



I have some lambdas running inside a vpc that are connecting to the internet when I set their security group egress rule to allow all outbound traffic but if I change that cidr rule to a specific ip (x.x.x.x/32) instead of all traffic ( and try to make a request to the respective host my requests time out. They are accessing the internet through a nat gateway and public/private subnets. I've tried working the mask backwards all the way down to all traffic but only the all traffic cidr will allow me to successfully make requests.

Any ideas? Thanks

posta 10 mesi fa248 visualizzazioni
2 Risposte


Are the IP addresses allowed in the outbound rules of the security group correct?
We would also need to check the protocols that are allowed.

profile picture
con risposta 10 mesi fa
  • Evidently not - I turned on flow logs and found the ips that were getting rejected and quickly added them to the outbound rules and that temporarily worked. After a few minutes my requests started to time out again and I'm not sure what caused it - also not sure where I should be finding the ips that were rejected. No host resolving tool returns them..

  • It may depend on what kind of service you are connecting to, but it may have multiple IP addresses.

  • Say I wanted to allow https requests to

  • If it's it resolves to the multiple IPv4 and IPv6 addresses. You can't expect that it will be always some fixed group of addresses. Some SaaS provide network CIDRs, so you can use them to whitelist, but never heard that Google does it for their site.


I would suggest enabling VPC flow logs and see what is being blocked when you use x.x.x.x/32

profile pictureAWS
con risposta 10 mesi fa

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande