Issue Connecting to EC2 Instance via Browser When Region Not Specified in Lambda Code

Question

I encountered an intriguing issue while working with AWS EC2 instances. In my specific use case, I aimed to launch an EC2 instance from a Lambda function accidentally I didn't specify the region in the code. Surprisingly, I could not connect to the EC2 instance via a browser. However, upon specifying the region in the code, the connection was successful.

Here's a snippet of the code I used:
```
import { EC2, DescribeInstancesCommand } from '@aws-sdk/client-ec2';
const ec2Client = new EC2();
export const handler = async (event) => {
    console.log("The function started");
    const params = {
      ImageId: 'ami-04b70fa74e45c3917',
      InstanceType: 't2.micro',
      MinCount: 1,
      MaxCount: 1,
    };
    const data = await ec2Client.runInstances(params);
}
```
I've attempted to understand the logic behind this behavior but haven't been successful so far. Could someone shed some light on why specifying the region affects the ability to connect to the EC2 instance via a browser?
Thank You!

Answer

Hello.

Are there any differences in the parameters of EC2 started with specifying a region and EC2 started without specifying a region?  
For example, are there any differences in the running subnets or security groups?  
If there are differences in the subnets, it may be a good idea to check the route table and see if there is a route to the Internet gateway.

Answer

Hard-coding the AMI ID `ImageId: 'ami-04b70fa74e45c3917',` implies the region anyway - this AMI is Ubuntu 24.04 in us-east-1 and as such an EC2 instance can only be launched using this AMI in that region. Plus I'm guessing the credentials you're using would have the region set as well anyway.

What are all the differences in your code when you specify a region, compared to when you don't? Is it just one line specifying the region and that's it, or are there more entries specifying any or all of AZ, VPC, subnet, etc.?

Lastly, when you talk of being able to connect to EC2 via a browser, are you trying to use Session Manager or Instance Connect (or something else)?

Answer

When you don't specify a region explicitly, AWS SDKs often default to a region based on the configuration of the AWS environment in which they are running. This configuration might be based on environment variables, AWS CLI settings, or other factors depending on the SDK and environment.

By default, Lambda functions are region-agnostic in their execution. By not specifying the region in your Lambda function code, you allowed the AWS SDK to default to a certain region. However, when you tried to connect to the EC2 instance via a browser, you might have attempted to access it from a different region or from a location outside the AWS network. AWS regions are isolated from each other by design, and resources launched in one region are not directly accessible from another region unless you explicitly set up networking between them.

When you specified the region in your Lambda function code, you ensured that the EC2 instance was launched in the desired region. Consequently, when you attempted to connect to it via a browser, you were likely accessing it from within the same region where it was launched, thus allowing the connection to succeed.

Issue Connecting to EC2 Instance via Browser When Region Not Specified in Lambda Code

Relevant content