Accessing Lambda function through a Site-to-Site VPN tunnel by static IP

Question

Hello AWS users and advocates!

Context:
- I am using AWS Lambda + API Gateway for my web service, the Lambda is in a VPC
- I am trying to integrate with a 3rd party that requires a secure host-to-host connection between services (VPN tunnel)
- The 3rd party integration is built as a webhook; the 3rd party will notify my service when certain events happen on their end
- The expectation from the 3rd party is that the webhook/service should be accessible via HTTP/S and available behind a single static IP address:
        For example, if the static IP inside the VPC is **10.0.10.1**, port is **9999**, and webhook path is **/webhook**, the 3rd party's service should be able to reach the webhook via **http://10.0.10.1:9999/webhook** once connected to the tunnel

What I've done so far:
- Set up a Site-to-Site VPN connection between the Lambda's VPC and the 3rd party network (done)
- Expose the Lambda function through private IP:
        This is the part I'm unsure about; I have tried to set up a VPC Endpoint for Lambda, but from what I've read elsewhere, this would not allow the Lambda function to be reached over HTTP

How can this be done?

Thanks

Answer

You can't trigger a Lambda function directly from a network call - the event that triggers Lambda has to come from a separate service (mostly). The exception here is Lambda function URL but because they aren't available in a VPC we can discount it as a solution in this case.

What you can do though is create a private API using API Gateway which will be in your VPC and from there it can trigger the Lambda function.

What you can do though is create a [private API using API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html) which will be in your VPC and from there it can trigger the Lambda function.

Accessing Lambda function through a Site-to-Site VPN tunnel by static IP

Relevant content