My lambda function is able to access internet sometimes and times out sometimes even after configuring with NAT gateway


I have followed the instructions of creating a private subnet and a public subnet. I have added route to internet gateway for public subnet and NAT gateway to private subnet. When attaching VPC configuration to the lambda function, I have set these two subnets. Sometimes I am able to access boto3 code inside the lambda function, but sometimes it timesout as if internet is not available. Please help me.

  • The problem is likely to be that you configured the Lambda function to launch in multiple (typically private) subnets but you neglected to provide a default route from one of those subnets to the NAT. The reason your Lambda functions works OK sometimes but not all the time is that sometimes it's launched into the subnet with the (good) NAT routing and sometimes into the subnet without NAT routing.

2 Answers
Accepted Answer

Hi it's not clear to me exactly what you're trying to do - do you want your Lambda to have just outbound internet access or to be fully public for inbound traffic? Does it even need to be a VPC Lambda? When configuring subnets for a Lambda you wouldn't provide both Public and Private subnets - you would provide subnets of the same type spread across AZs.

answered a year ago
  • Thank you for the quick reply. I don't need inbound internet connection. VPC Is required to get aws RDS database support. Internet access is required for calling a URL to get some information. I think I figured out the problem. I removed the public subnet. I hope I won't face those issues now.


NAT gateways Internet connection drops after 350 seconds


Your instances can access the internet, but the connection drops after 350 seconds.


If a connection that's using a NAT gateway is idle for 350 seconds or more, the connection times out.

When a connection times out, a NAT gateway returns an RST packet to any resources behind the NAT gateway that attempt to continue the connection (it does not send a FIN packet).


**To prevent the connection from being dropped, you can initiate more traffic over the connection. Alternatively, you can enable TCP keepalive on the instance with a value less than 350 seconds. **

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions