Lambda times out calls to VPC endpoint

Question

I have a lambda function in private subnet. I have configured it with `iot` VPC endpoint `data.iot.us-east-1.amazonaws.com`. Also, I have manually added private hosted zone & an alias record in that zone resolving to VPC endpoint.

In the lambda I use boto3 to call methods like `list_things, delete_thing, delete_thing_group`. Lambda execution times out. I have it configured for 5 sec.

I have configured lambda SG and outbound rule to allows on all ports with in VPC CIDR range 10.2.0.0/16. I have also added 0.0.0.0/0 as well for testing.
I have checked VPC endpoint SG as well. Both inbound and outbound rules allow on all ports with in VPC CIDR range 10.2.0.0/16. I have also added 0.0.0.0/0 as well for testing.

I thought may be DNS resoultion is not working. So, I added this python code to lambda

```
data = socket.gethostbyname_ex('data.iot.us-east-1.amazonaws.com')
print (data)
```
Its resolving to my VPC IP address.

Keeping all SG rules of lambda, VPC endpoint unchanged, I changed private subnet to private with NAT subnet. It works. DNS resolution also resolves to VPC ips.
`('data.iot.us-east-1.amazonaws.com', [], ['10.2.3.223', '10.2.4.116'])`

What could be the issue?

re:Post Agent · Accepted Answer

Hello,

Note that the data.iot.us-east-1.amazonaws.com is used for performing Data Plane operations such as Publish, Subscribe. All the other operations mentioned above like list_things, delete_thing, delete_thing_group are control plane operations which can not be performed by making use of IoT Data VPC Endpoint.  All the control plane operations should be performed to the public AWS IoT endpoint. VPC endpoints for AWS IoT are currently supported only for AWS IoT Core data endpoints and AWS IoT Core credential provider endpoints.

Further information on the endpoints can be found below :

https://docs.aws.amazon.com/general/latest/gr/iot-core.html
https://docs.aws.amazon.com/iot/latest/developerguide/IoTCore-VPC.html

Shahed Kazi (@shajam) · Answer

If I understand correctly, you can only reach data.iot.us-east-1.amazonaws.com over a private subnet with internet connect (via Nat gateway) and you want to know why it needs internet.

The reason is, data.iot.us-east-1.amazonaws.com is a public endpoint. To reach public endpoints, you will need internet connection and hence the Nat Gateway configuration. If you are worried about having internet connection, then there are couple of things you can do.

* Configure a private endpoint for data.iot.us-east-1.amazonaws.com using private link / VPC interface. This will give you option for private connectivity but you will need to pay for the interface endpoint and also processing fees. 
* Have reduced internet - that is, configure Nat Gateway but by using security group, you can only allow outbound connections over port 443 to 0.0.0.0/0. AWS also publishes their public IP range, you can also just limit to that.

Public IP range: https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html
Interface Endpoint: https://docs.aws.amazon.com/vpc/latest/privatelink/interface-endpoints.html

Lambda times out calls to VPC endpoint

Add your answer

Relevant content