Lambda in VPC access to Pinpoint issue connect timed out

0

Lambda in VPC need access to Pinpoint service and S3 bucket. Created:

  • VPC, API Gateway, Subnet, S3 bucket and Lambda
  • Endpoint Interface to Pinpoint from VPC (correct VPC, Subnet and Security group)
  • Endpoint gateway to S3
  • Lambda execution policy update to access Pinpoint
  • Lambda execution policy update to access S3
  • S3 Policy to to allow Lambda access

Result:

  • Lambda access S3 bucket no issues.
  • Lambda can't access Pinpoint

Lambda log: Caused by: org.apache.http.conn.ConnectTimeoutException: Connect to pinpoint.ca-central-1.amazonaws.com:443 [pinpoint.ca-central-1.amazonaws.com/X.X.X.X] failed: connect timed out

Am I missing something? Do I need routing to Pinpoint from VPC? How to test endpoint connection?

Thanks!

Haris
asked 13 days ago80 views
1 Answer
0

It sounds like you have done the right things to set up access from your Lambda function in your VPC to Pinpoint. A few things to check:

  • Double check that the security group assigned to the Lambda function allows outbound access to the Pinpoint service endpoints. It needs to allow egress on port 443 to pinpoint.*.amazonaws.com.

  • Verify that the route table for the Lambda's subnet routes traffic destined for the Pinpoint prefixes to the VPC endpoint you created. You can get the service prefixes to route from the AWS documentation.

  • Check that the subnet for the Lambda has an internet gateway or NAT gateway route so it can resolve DNS and establish connections.

  • Try testing connectivity to Pinpoint from within the VPC subnet, such as from an EC2 instance, to isolate whether this is a Lambda specific issue.

  • Check CloudWatch logs for any other errors or details on the timeout.

  • Ensure there are no NACL rules blocking access.

Some things to try to further troubleshoot:

  • Use a tool like Wireshark to inspect traffic and see if connections are being initiated properly.

  • Temporarily assign a public IP to the Lambda to bypass the VPC to see if it works.

  • Verify security group rules are stateful to allow return traffic.

  • Check Lambda VPC config has DNS resolution enabled.

The key is likely ensuring connectivity from the subnet to Pinpoint, proper routes, and security groups. But without more detailed logs or troubleshooting it's hard to pinpoint the exact issue. Hopefully this gives you some ideas on additional things to verify or try!

AWS
answered 13 days ago
profile picture
EXPERT
reviewed 13 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions