Skip to content

Lambda Function Unable to Access the Internet Despite No VPC Configuration

0

I have deployed a Node.js 18.x AWS Lambda function using the Serverless Framework in us-west-1, and it is supposed to make outbound requests to the following services:

  • Google Sheets API
  • Slack API
  • Twilio API

However, my function fails to access any external internet service despite the following configurations being verified:

The Lambda Function Is Not in a VPC

  • The function is deployed with no VPC attached, which should allow full outbound internet access.

The IAM Role Has Correct Permissions

  • The Lambda execution role includes:
  • AWSLambdaBasicExecutionRole
  • AWSLambdaVPCAccessExecutionRole
  • Custom policy allowing outbound traffic:
{
    "Effect": "Allow",
    "Action": [
        "logs:CreateLogStream",
        "logs:CreateLogGroup",
        "logs:PutLogEvents",
        "ec2:DescribeNetworkInterfaces",
        "ec2:CreateNetworkInterface",
        "ec2:DeleteNetworkInterface",
        "ec2:AssignPrivateIpAddresses",
        "ec2:UnassignPrivateIpAddresses"
    ],
    "Resource": "*"
}

CloudWatch Logs Confirm Timeouts

  • API Gateway is working correctly and is logging API calls.
  • Lambda logs show that all outbound HTTP requests fail with timeouts, including basic connectivity checks like: axios.get("https://httpbin.org/get", { timeout: 5000 });

We Deployed to Multiple Regions and Observed the Same Issue

  • We deployed to both us-west-1 and us-east-1, and the function fails in the exact same way.
  • This rules out a region-specific issue.

CloudWatch Logs Are Working and Show No Other Errors

  • No permission errors or other AWS-related failures appear in CloudWatch.

Additional Notes:

  • We initially suspected service control policies (SCPs), but they are disabled at the organizational level.
  • The function is not using NAT Gateways or private subnets, which could restrict outbound traffic.
  • The behavior persists across all redeployments and manual IAM updates.

Running out of things to check now so I figured I'll reach out to the community and see if anyone might have ideas.

asked 8 months ago211 views
2 Answers
0

Hello,
Do you have relevant logs of a Lambda execution showing the error?
If you have a timeout error, did you try to extend the Lambda function timeout?
Lambda Function configure timeout
Troubleshoot networking issues in Lambda

For your information, you have added unnecessary permissions to your Lambda.
AWSLambdaBasicExecutionRole should be enough unless you need access to other AWS services.

You mentioned NAT Gateway and subnets, but they are irrelevant since your Lambda is not in a VPC. Make sure that your Lambda function is outside of your VPC, which is normally the default configuration.

answered 8 months ago
EXPERT
reviewed 8 months ago
  • The log errors come from dummy tests we've inserted in the function as simple as:

    try { console.log(🔍 Testing https://httpbin.org/get...); const response = await axios.get("https://httpbin.org/get", { timeout: 5000 }); console.log(✅ SUCCESS for https://httpbin.org/get:, response.status); } catch (err) { console.error(❌ FAILED for https://httpbin.org/get:, err.message); }

    in which we'll get

    ERROR ❌ FAILED for https://httpbin.org/get: timeout of 5000ms exceeded

    The Lambda timeout has been set to 29s which shouldn't be the issue since the execution normally completes <2s

    As far as the permissions go, you're absolutely right. It was just sheer desperation at this point trying to figure out why a simple get will be blocked in our lambda function that doesn't have a VPC attached and should be able to access the internet

  • I think is probably related to the code itself and not AWS configurations. There is no reason of getting no internet access from your lambda function, outside of your VPC.

    I've tested a very simple code, from yours :

    import axios from "axios";
    
    export const handler = async () => {
        try {
            console.log("🔍 Testing https://httpbin.org/get...");
            const response = await axios.get("https://httpbin.org/get", { timeout: 5000 });
            console.log("✅ SUCCESS for https://httpbin.org/get:", response.status);
            return {
                statusCode: 200,
                body: JSON.stringify(response.data),
            };
        } catch (err) {
            console.error("❌ FAILED for https://httpbin.org/get:", err.message);
            return {
                statusCode: 500,
                body: JSON.stringify({ error: err.message }),
            };
        }
    };

    It works well on my side. Have you tried using Axios in your main Lambda function with others configurations, or tried creating a simple and minimal Lambda function to test? Do you have other lambda which is working?

  • The code itself should be fine since it runs flawlessly on local (using ngrok tunneling). E2E tests with all external services passes. There's only an issue when we deploy this via serverless to lambda and specifically those issues (i.e. the app cannot seem to reach any external service). That's a good callout tho. I'll deploy a simple function to test and see if all lambdas are messed up in which case its probably some obscure account thing. I'll update!

  • Oh geez I'm such an idiot but I figured it out. See the invoker of the function has a pretty narrow timeout window so we respond immediately and dispatch the actual task async (and notify via callbacks and all that). It would appear for Lambdas that once you commit your response, AWS will forcibly kill your thread even if its running. There's no set time window to which it does that which was what made troubleshooting such a challenge since the logs were highly inconsistent. Sometimes the application would reach a certain stage and other times it gets terminated way before.

    Pretty much means lambdas are not suitable for this use case I reckon. Thanks for your responses Brandon!

  • Ahah thank you for the feedback!
    If I’ve helped you don’t forget to mark it as resolved, good luck in your project !

0

Based on the information provided, it appears that your Lambda function should indeed have internet access. However, there are a few points to consider and potential solutions to explore:

  1. Default Internet Access: By default, Lambda functions that are not attached to a VPC have access to the public internet. The fact that your function is not in a VPC should allow it to make outbound internet requests without any additional configuration.

  2. IAM Permissions: While you've included the necessary IAM permissions for VPC access, these are not required for a Lambda function that's not in a VPC. The AWSLambdaBasicExecutionRole should be sufficient for a function that only needs to write to CloudWatch Logs and access the internet.

  3. Function Configuration: Double-check your function configuration to ensure it's truly not associated with any VPC. Sometimes, VPC settings can be inadvertently applied during deployment.

  4. Code Issues: The problem might be in your function code. Ensure that your Node.js code is correctly handling promises and async operations. A common issue is that the function might be timing out before the external API calls complete.

  5. Execution Environment: Try testing with a simple function that just makes a single HTTP request to a known endpoint (like https://httpbin.org/get). This can help isolate whether the issue is with your specific APIs or a more general connectivity problem.

  6. Timeouts: Check if your function's timeout setting is sufficient for the external API calls to complete. If the function times out before receiving a response, it might appear as if internet access is blocked.

  7. Dependencies: Ensure all necessary dependencies (like 'axios') are properly included in your deployment package.

  8. AWS Support: If none of the above resolves the issue, it might be worth contacting AWS Support. There could be an underlying issue with the Lambda service in your account or regions.

Remember, Lambda functions by default have internet access when not connected to a VPC. The fact that you're experiencing this issue across multiple regions suggests it might be related to your account configuration or code rather than a regional Lambda service problem.
Sources
Lambda function can access the internet from Function URL but not from API Gateway | AWS re:Post
Giving Lambda functions access to resources in an Amazon VPC - AWS Lambda

answered 8 months ago
EXPERT
reviewed 8 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.