Timeout error when SSHing into EC2 instance using Lambda with VPC configuration

Question

I am trying to SSH into an EC2 instance using Lambda. The code works fine without VPC configuration, but when I configure it to VPC, I get a timeout error. I created two security groups: sg-lambda and sg-ec2. sg-lambda is attached to the Lambda function and sg-ec2 is attached to the EC2 instance. The rules for both security groups are as follows:

Here is a table of the inbound and outbound rules for both security groups:

| Security group | Inbound rule | Outbound rule |
| --- | --- | --- |
| sg-lambda | SSH (TCP 22) from anywhere | All traffic to anywhere |
| sg-ec2 | SSH (TCP 22) from security group sg-lambda | All traffic to anywhere |

Accepted Answer

When you enable VPC for Lambda you also need specify in which subnet it will be deployed. Could it be that there are no routes between the subnet where Lambda is deployed and subnet where is EC2?

Answer

Hi,

Is that EC2 instance deployed in different VPC than lambda ? If so, please make sure there is route to the destination CIDR routing via VPC peering or TGW. Since you get timeout error, it's possible that routing is misconfigured.

If EC2 instance is deployed in the same VPC/subnets as lambda, then routing shouldn't be a problem. Here you need to make sure NACL's are configured properly to allow-list Lambda traffic.

Another option to test this is by deploying a test instance in the same subnet as your lambda and run VPC reachability analyzer ? It will help to determine where the traffic is getting stopped and identify any issues

Thank you.

Answer

Have you defined proper routes in the routing table in Subnets where Lambda function is deployed?

Security group	Inbound rule	Outbound rule
sg-lambda	SSH (TCP 22) from anywhere	All traffic to anywhere
sg-ec2	SSH (TCP 22) from security group sg-lambda	All traffic to anywhere

Timeout error when SSHing into EC2 instance using Lambda with VPC configuration

Relevant content