Use Boto3 in a Lambda Function to Work work with API Gateway

Question

Hi,

I have a Lambda function attached to a VPC and private subnets. This lambda function will be used for API Gateway Usage Plan reporting purposes. So I want to get Usage Plan api usage using Boto3. I get timeout error in my lambda function. Apparently the lambda can't connect to API Gateway somehow. What's the best way to this? Do I need a NAT Gateway for this?

My preference is to not use a NAT Gateway.

Thanks

Riku_Kobayashi · Accepted Answer

Hello.

As you know, to access AWS services from a Lambda connected to a VPC, you need to use VPC endpoints or use a NAT Gateway.  
I believe you are using the "get-usage" API to retrieve the usage of an API Gateway usage plan, which requires access to the API Gateway control plane.  
https://repost.aws/knowledge-center/internet-access-lambda-function

As of September 2024, VPC endpoints cannot be used for the control plane of API Gateway, so NAT Gateway must be used instead.  
https://docs.aws.amazon.com/general/latest/gr/apigateway.html

Parthasaradi · Answer

Hello,

* Yes you will need a NAT Gateway for your Lambda function to access API Gateway when it's in a VPC with only private subnets.

* When you attach a Lambda function to a VPC and place it in private subnets, those subnets typically don't have direct access to the internet. This means the Lambda function can't reach public AWS services, such as API Gateway, unless you provide it with a way to access the internet.

* A NAT Gateway allows instances in a private subnet to send outbound traffic to the internet but doesn't allow inbound traffic from the internet to those instances.

https://repost.aws/knowledge-center/internet-access-lambda-function

https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html

Use Boto3 in a Lambda Function to Work work with API Gateway

Relevant content