KMS decrypt error inside Lambda in VPC network timeout

Question

I have a lambda which needs to be exposed to the internet and also needs outgoing internet network access.
This lambda needs to decrypt some environment variables on startup (KMS). This encryption fails sometimes. 
This lambda is running in a VPC with 2 private subnets and 1 public. The private subnets have a routing table to NAT-gateway.
The lambda has required KMS permissions.  Also I configured a VPC endpoint for KMS.
However I get frequently network timeout errors to KMS
INFO Decrypt error: Error: read ECONNRESET at TLSWrap.onStreamRead (node:internal/stream_base_commons:217:20) { errno: -104, code: 'ECONNRESET', syscall: 'read', name: 'TimeoutError', '$metadata': { attempts: 7, totalRetryDelay: 5866 } }
Any suggestions are more then welcome.
Thanks in advance.

Riku_Kobayashi · Accepted Answer

Is the subnet where Lambda is located a private subnet?  
Or is it a public subnet?  
Do you have KMS VPC endpoints set up on public subnets as well?  
Lambdas in the VPC do not have a global IP address even if they are located on a public subnet, so you need to set up a VPC endpoint.  
Alternatively, you can also communicate by manually setting a public IP address in the Lambda's ENI.  
Otherwise, make sure that the required security groups are set up for the KMS VPC endpoints

KMS decrypt error inside Lambda in VPC network timeout

Relevant content