Connecting Lambda inside a VPC to resources outside a VPC

Another option that might work (I haven't tried it myself) if the other suggestions aren't possible for some reason is to put the Lambda in a public subnet and attach an Elastic IP to its ENI. Since the VPC Lambda networking improvements of 2019/20 the ENIs are long-lived but still AWS do not recommend doing this because the ENI could be deleted if unused for weeks, and could be supplemented by additional ENIs if there's high concurrency. This approach maybe could work if set up carefully.

When you place a Lambda function in a VPC to access resources like ElastiCache Serverless, you're correct that the function loses direct internet access and can't reach AWS services outside the VPC by default.

For accessing AWS services without using a NAT Gateway, AWS PrivateLink with interface VPC endpoints is the recommended approach. This allows your Lambda function to privately access AWS services without traversing the public internet.

You can create interface VPC endpoints for most of the services you mentioned:

• API Gateway
• Cognito
• Parameter Store (Systems Manager)

However, you're correct that CloudFront doesn't currently support VPC endpoints. For this specific service, you have limited options:

1. Use a NAT Gateway (which you want to avoid)
2. Consider an IPv6 approach - Lambda functions can make IPv6 outbound connections, and you could use an Egress-only Internet Gateway instead of a NAT Gateway
3. Restructure your application to handle CloudFront interactions from components that aren't in the VPC

Using VPC endpoints for the supported services will help minimize your dependency on internet access. Interface endpoints are powered by AWS PrivateLink and are generally more cost-effective than NAT Gateways while providing secure private connectivity between your VPC and AWS services.

For your specific architecture, you could implement VPC endpoints for API Gateway, Cognito, and Parameter Store, then evaluate whether you can restructure the CloudFront interactions or if you'll need to use one of the alternative approaches for that specific service.
Sources
Leverage VPC endpoints - Serverless Applications Lens
Lambda in RDS VPC needs bi-directional inet access | AWS re:Post
Configure Lambda without NAT for trigger API Gateway and use DocumentDB | AWS re:Post
Connect your VPC to services using AWS PrivateLink - Amazon Virtual Private Cloud

Yes, you can create Interface VPC Endpoints (AWS PrivateLink) for most of the services you mentioned, including:

Amazon API Gateway (for private APIs)

AWS Cognito

AWS Systems Manager Parameter Store

These services support interface endpoints, allowing secure, private connectivity over the AWS network without using the public internet.

Regarding CloudFront: CloudFront does not support VPC endpoints directly because it's a global edge service that acts as a content delivery layer in front of your origin (e.g., ALB or S3).

However, if your CloudFront origin is:

An Application Load Balancer (ALB) within a VPC

Or an S3 bucket (with static website hosting disabled)

You can:

Expose the origin using an Interface VPC Endpoint (PrivateLink)

Set up a private DNS name using Route 53 that resolves to the VPC endpoint

Configure CloudFront with a custom origin domain name that routes through the PrivateLink

This ensures that CloudFront communicates privately with your internal origin resources without traversing the internet.