Access SQS using VPC Endpoint from AWS Lambda in private subnet

Question

Here is sam template where I defined vpc, subnets, lambda, sqs queue and vpc endpoints and security group
Lambda pull from sqs by schedule but looks like I can't connect

```
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Parameters:
  QueueName:
    Type: String
    Default: MyQueue
    Description: Name of the SQS queue to be created.

Resources:
  SqsQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Ref QueueName

SQSVPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.sqs"
      VpcId: !Ref VPC
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref PrivateSubnetsAZ1
        - !Ref PrivateSubnetsAZ2
      SecurityGroupIds:
        - !Ref LambdaSQSSecurityGroup

LambdaSQSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow Lambda to access Aurora and SQS VPC Endpoint
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 10.0.0.0/16  # Aurora access
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 10.0.0.0/16  # SQS VPC Endpoint access

VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      Tags:
        - Key: Name
          Value: "LambdaAuroraVPC"

PrivateSubnetsAZ1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [ 0, !GetAZs '' ]  # First AZ
      Tags:
        - Key: Name
          Value: "PrivateSubnetAZ1"

PrivateSubnetsAZ2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: !Select [ 1, !GetAZs '' ]  # Second AZ
      Tags:
        - Key: Name
          Value: "PrivateSubnetAZ2"

AuroraDBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: "Aurora DB Subnet Group"
      SubnetIds:
        - !Ref PrivateSubnetsAZ1
        - !Ref PrivateSubnetsAZ2

SQSToAuroraLambda:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: LambdaAuroraAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - rds-data:*
                  - ssm:GetParameter
                  - ssm:GetParameters
                  - secretsmanager:GetSecretValue
                Resource: '*'
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: "arn:aws:logs:*:*:*"
              - Effect: Allow
                Action:
                  - ec2:CreateNetworkInterface
                  - ec2:DescribeNetworkInterfaces
                  - ec2:DeleteNetworkInterface
                Resource: "*"
              - Effect: Allow
                Action:
                  - sqs:SendMessage
                  - sqs:ReceiveMessage
                  - sqs:DeleteMessage
                  - sqs:GetQueueAttributes
                  - sqs:GetQueueUrl
                Resource:
                  - !GetAtt SqsQueue.Arn

SqsProcessorFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: vsvdev.co.ua.Fun::handleRequest
      Runtime: java17
      # CodeUri: .
      CodeUri: target/cleaner-0.1-lambda-package.zip
      MemorySize: 512
      Timeout: 120
      VpcConfig:
        SecurityGroupIds:
          - !Ref LambdaSQSSecurityGroup
        SubnetIds:
          - !Ref PrivateSubnetsAZ1
          - !Ref PrivateSubnetsAZ2
      Environment:
        Variables:
          QUEUE_ARN: !GetAtt SqsQueue.Arn
          QUEUE_URL: !Ref SqsQueue
          MAIN_CLASS: vsvdev.co.ua.Application
      #          DB_HOST: 
      #          DB_PORT:
      #          DB_NAME: db
      #          DB_USERNAME: postgres
      #          DB_PASSWORD: example
      Role: !GetAtt SQSToAuroraLambda.Arn

Events:
        Timer:
          Type: Schedule
          Properties:
            Schedule: cron(37 9,17 * * ? *) # 9:00 AM and 5:00 PM UTC daily

Outputs:
  QueueUrl:
    Value: !Ref SqsQueue
    Description: URL of the primary SQS queue.
  QueueArn:
    Value: !GetAtt SqsQueue.Arn
    Description: ARN of the primary SQS queue.
  FunctionName:
    Value: !Ref SqsProcessorFunction
    Description: Name of the Lambda function.

```

And in VPC route table I can't see sqs

Riku_Kobayashi · Accepted Answer

Hello.

I can't know the details without looking at the Lambda error message, but I thought that Lambda was probably unable to resolve the name of the SQS VPC endpoint and was failing to access it.  
Try enabling private DNS on the SQS VPC endpoint as follows.  
```
  SQSVPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.sqs"
      VpcId: !Ref VPC
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref PrivateSubnetsAZ1
        - !Ref PrivateSubnetsAZ2
      SecurityGroupIds:
        - !Ref LambdaSQSSecurityGroup
      PrivateDnsEnabled: True
```
Also, try enabling private DNS settings for your VPC.  
```
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      Tags:
        - Key: Name
          Value: "LambdaAuroraVPC"
      EnableDnsHostnames: True
      EnableDnsSupport: True
```

Gary Mclean · Answer

You do not have any OUTBOUND (Egress) rules on your LambdaSQSSecurityGroup. This is preventing lambda from connecting outbound to RDS and SQS

You also do not need rds-data:* if your connecting natively to PostGres on 5432. rds-data:* is only needed if your using the https APi to pull data.

Access SQS using VPC Endpoint from AWS Lambda in private subnet

Add your answer

Relevant content