API GW Websockets and public subnets

Question

Hi,
I have a publicly available API GW Websockets, I have a lambda and ec2 instance in a VPC in a public subnet with IGW and correct routing tables. I have all security groups opened but when I try to `post_to_connection` using `boto3.client('apigatewaymanagementapi')` the connection timeouts in Lambda, or I get this error in EC2 when I run

```
$ aws apigatewaymanagementapi  post-to-connection --data 'hello' --connection-id 'OuoMyd3eDoECJpQ=' --region eu-west-1

Could not connect to the endpoint URL: "https://execute-api.eu-west-1.amazonaws.com/@connections/OuoMyd3eDoECJpQ%3D
```

Not sure what's wrong, I tried putting the EC2 into a private subnet with a NAT gateway and VCPE endpoint for API GW but no luck.

EDIT:
I found the issue with the aws-cli command, I actually had to specify the `endpoint_url` pointing to the `connection_url` of the API GW. This works, but for some reason I still can't post any messages from within the lambda which is on the same VPC and public subnet.

Accepted Answer

When attaching Lambda functions to a VPC they do not receive a public IP. For them to be able to communicate outside the VPC they need to be placed in a private subnet and use a VPC Endpoint or a NAT Gateway.

API GW Websockets and public subnets

Relevant questions

AWS Nitro Enclave instance does not have public ipv4 address

Should a non-public RDS instance have a publicly resolvable DNS name?

Access lambda in custom VPC from public API Gateway

API GW Websockets and public subnets

I have not connect ec2 instance by instance and ssh key

Have a VPC using a 10.1.0.0/16

Create API GW Websocket API that is only accessible from within a VPC.

How can API Gateway WebSockets be throttled per-user?

Can you use a signed URL with S3 VPC Endpoint?

Protect and secure http API GW