By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Connect a Lambda function to an S3 bucket while being connected to a VPC to make queries to a private RDS.

0

I'm creating a Lambda function that receives parameters in a POST request, including an object (CSV file) that I need to access and execute a series of queries based on its content to a private RDS.

I can access the S3 bucket if the Lambda function is not associated with a VPC, but in this case, I cannot access the private RDS. Also I have reviewed the security groups, route tables, and there is an internet gateway. I have also checked the IAM policies, which allow listing and reading from any bucket.

Topics
StorageNetworking & Content DeliveryServerlessComputeDatabase
Tags
Amazon Simple Storage ServiceAmazon VPCAWS LambdaAurora PostgreSQL
Language
English
jlroser
asked a year ago555 views
2 Answers
3
Accepted Answer

This is very common scenario as same applicable for all compute. As a best practice you should create Lambda within VPC so you can access RDS. To access S3 from Lambda function inside a VPC, use VPC endpoints

profile pictureAWS
Nirmal
answered a year ago
profile picture
EXPERT
Giovanni Lauria
reviewed a month ago
  • Gary Mclean EXPERT
    a year ago

    And or have your Lambda function connect to a subnet with a route to a NAT gateway to provide internet connectivity so that you can reach services such as S3.

    However, I do agree with Nirmal. Create VPC Endpoints. I believe a S3 gateway endpoint is free. Make sure you have a route with the preflix list applied to the subnet where your Lambda function connects

  • jlroser
    a year ago

    Thanks to all. I follow the advice and create the endpoint and works properly.

1

You must connect the Lambda to a VPC that can communicate with the database or look at other options, such as RDS Proxy or the RDS Data API. I haven't used RDS Proxy or RDS's Data API recently, and I can't remember if they enable communication with the DB without being in the private VPC, but that is where I would look first.

profile picture
Jason Butz
answered a year ago
  • jlroser
    a year ago

    Thanks for the advice, I made the endpoint first and it works, perhaps in another time I can try the proxy.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content