Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Cloudformation Lambda Function inside a VPC with Dualstack IPv6 ResponseURL

0

I'm trying to create a Cloudformation Lambda function inside a VPC and utilize IPv6 for the ResponseURL. I have tried an number of approaches with limited success. My VPC and subnets are dualstack with an EIGW and routing. From EC2 instances I can access IPv6 Internet sites. From within my Cloudformation Lambda I can resolve IPv6. But the ResponseURL for S3 does not use the "dualstack" URL. I tried replacing the URL FQDN with the dualstack version, no joy. Currently I'm trying to generate my own presigned URL (botot3 s3 generate_presigned_url) using the using info from the provided URL (bucket and key), but getting 403 error.

Topics
ServerlessManagement & GovernanceComputeStorage
Tags
AWS CloudFormationAmazon S3 Access GrantsAWS Lambda
Language
English

asked 10 months ago269 views

1 Answer
0

To enable IPv6 for your CloudFormation Lambda function's ResponseURL, you'll need to address several components:

First, ensure your VPC is properly configured for IPv6. It sounds like you've already set up your VPC with dual-stack support, an Egress-Only Internet Gateway (EIGW), and appropriate routing, which is good.

For Lambda functions to use IPv6, you have a few options:

  1. Function URLs: Lambda function URLs are dual stack-enabled by default, supporting both IPv4 and IPv6. These endpoints have the format https://<url-id>.lambda-url.<region>.on.aws. If you're using function URLs to invoke your Lambda, IPv6 should work automatically.

  2. For AWS SDK calls within your Lambda function, you can enable dual-stack endpoints by setting the environment variable AWS_USE_DUALSTACK_ENDPOINT=true. This will make the AWS CLI and SDKs automatically construct the appropriate dual-stack endpoints without requiring manual URL specification.

  3. For S3 specifically, if you're trying to use S3 on Outposts with IPv6, you'll need to use a dual-stack interface endpoint. This can be created using the AWS CLI with the create-vpc-endpoint command, specifying --ip-address-type dualstack and --dns-options "DnsRecordIpType=dualstack".

If you're still experiencing issues with the S3 ResponseURL, consider:

  • Checking that your security groups and network ACLs allow IPv6 traffic
  • Verifying that your IAM policies include IPv6 address ranges if you're filtering by IP
  • Ensuring your Lambda function has the proper permissions to access the S3 bucket

For the 403 error when using the presigned URL approach, this typically indicates a permissions issue. Make sure the IAM role associated with your Lambda function has the necessary S3 permissions, and that the presigned URL is generated with the correct parameters matching the original ResponseURL.
Sources
Using IPv6 with Amazon RDS Data API - Amazon Aurora
Understanding Lambda function invocation methods - AWS Lambda
Add IPv6 support for your VPC - Amazon Virtual Private Cloud
Making requests to S3 on Outposts over IPv6 - Amazon S3 on Outposts
Invoking Lambda function URLs - AWS Lambda

answered 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content