Lambda in RDS VPC needs bi-directional inet access

Question

We have a lambda who's function is to abstract a Cognito service from our clients.  It shares a VPC with an RDS so we can translate our external client application credentials into Cognito clientId and clientSecret.  It uses the real Cognito credentials from the database to retrieve a Bearer token and returns that to the client. 
 Once I put the lambda in the VPC it can access the database but it can no longer access the Cognito service.  The http request times out.  I've read several articles about the required configuration but I can't get it to work.

Leo K · Answer

You should place the Lambda function in the private subnets of your VPC and associate them with a private route table (or a separate one per AZ) with the default route 0.0.0.0/0 pointing to a NAT gateway located in a public subnet. For high availability and to eliminate cross-AZ traffic charges, you may want to have a separate NAT gateway in each availability zone and correspondingly a separate private route table for each AZ's private subnet. The public subnets' route table should have the default route pointing to an internet gateway (IGW).

When a Lambda function is connected to a VPC, it obeys the same routing logic as other resources in the VPC. To access the public, internet-facing endpoints of AWS services or external systems, you'll need a route to the internet. A Lambda function uses a special type of ENI (elastic network interface) called a hyperplane ENI to connect to your VPC, and not having a public IPv4 address, the only way it can connect to the internet over IPv4 is through a NAT gateway.

A simple diagram of the private/public subnet structure is included in this documentation article: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-example-private-subnets-nat.html. In this context, the Lambda function would be connected to where the "servers" are in the diagram. The Application Load Balancers aren't relevant for the Lambda use case.

Steve Kinsman · Answer

In addition to Leo K's answer addressing IPv4, note that as per https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-support.html Cognito public endpoints support IPv6, and Lambda functions can make IPv6 outbound connections - see https://aws.amazon.com/about-aws/whats-new/2023/10/aws-lambda-ipv6-outbound-connections-vpc/. So it may be an option for you to use an Egress-only Gateway instead of NAT Gateway to connect to the Cognito service.

For many services a VPC Interface Endpoint is also an option, but not for Cognito at this time. https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html

Lambda in RDS VPC needs bi-directional inet access

Add your answer

Relevant content