Pushing to SQS through VPC Endpoint from lambda in private VPC fails

0

Hello!
I have setup a private VPC where some lambda functions reside. Now I would like one of the lambdas to send messages to a SQS queue. For that I have created a VPC Endpoint to SQS.
The policy for the VPC endpoint allows everything for every user.
The policy for the SQS queue allows all SQS operations on the queue from everywhere.
The policy on the lambda function allows all SQS operations.
The Security Group of the VPC Endpoint allows all traffic on all protocols.

Everything is on eu-central-1.
The lambda that I want to send a messate to SQS times out here at the send_message call:

def send_message():
sqs_client = boto3.client("sqs", region_name="eu-central-1")

_message = {"key": "value"}_  
_response = sqs_client.send_message(_  
    _QueueUrl="https://sqs.eu-central-1.amazonaws.com/<user-id>/<queue-name>",_  
    _MessageBody=json.dumps(message),_  
    _DelaySeconds=12_  
_)_  
_print ("Response: ", response)_  

(Of course I have substituted the user-id and queue-name with the actual ones).
I have also tried all the DNS addresses that VPC Endpoint provides, but none work.

What have I missed?

已提問 3 年前檢視次數 2662 次
3 個答案
0

Hi,

You should also have a look at the security groups for the Lambda function, and the Network ACL for the subnets that the function resides in.

AWS
已回答 3 年前
0

As of what I have understood, you are not required to add specific routes to the VPC Endpoint in the private subnets to get it working. Also, the Security Group is allowing all traffic on all protocols and ports.

The security group of the lambda function is allowing all outbound traffic.

已回答 3 年前
0

Oh, I had to set an inbound rule on the SG for the Lambda function that allows all traffic on all protocols and ports for the same SG that the VPC Endpoint had.

已回答 3 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南