In VPC, EC2 works, lambda fails on call to iot:describe-endpoint

I have an EC2 instance and a lambda. They have the same:

• region
• VPC
• subnets
• security groups
• inbound rules
• outbound rules
• iot permissions

On EC2:

$ aws iot describe-endpoint --endpoint-type iot:Data-ATS

returns my accounts endpoint address.

I want to run the equivalent on a lambda:

const client = new IoTClient({});
const response = await client.send(
            new DescribeEndpointCommand({ endpointType: "iot:Data-ATS" })
        );

client does not return (and the lambda times out).

If I move the lambda out of the VPC, client returns a response and it is correct.

I cannot see why describe-endpoint works on EC2 in a VPC, but not on lambda in the same VPC (with the same apparent subnet, security group, and permissions).