How do I connect a Lambda function to a dedicated VPC?

Short description

Lambda functions can't connect directly to a Amazon VPC with dedicated instance tenancy. To connect a Lambda function to a dedicated VPC, peer the dedicated VPC to a default tenancy VPC that contains the function. For more information, see Giving Lambda functions access to resources in an Amazon VPC.

Resolution

Note: This solution requires an Amazon Elastic Compute Cloud (Amazon EC2) Dedicated Instance to test connectivity.

Create and configure a default tenancy VPC and a dedicated tenancy VPC

Note: If you choose different CIDR blocks than the ones in this article, then make sure that the two VPCs have non-overlapping CIDR ranges.

Complete the following steps:

1. Open the VPC console.
2. Choose Create VPC, and then configure the following:
   For Resources to create, choose VPC only.
   For IPv4 CIDR block, enter 12.0.0.0/16.
   For Tenancy, choose Default.
3. Choose Create VPC.
4. Create a second VPC with the following configuration:
   For Resources to create, choose VPC only.
   For IPv4 CIDR block, enter 11.0.0.0/16.
   For Tenancy, choose Dedicated.
5. Choose Create VPC.
6. Create an internet gateway and attach it to your dedicated tenancy VPC.
   Note: The internet gateway is required for the HTTP server that you create later in the Test connectivity section.
7. Create subnets in each VPC. For your default tenancy VPC, create two or more subnets across different Availability Zones.
   Note: It's a best practice to create more than one subnet across different Availability Zones for redundancy and provides high availability for your function. For multiple subnets in each VPC, use a subset of the VPC's CIDR block. If you create only one subnet in a VPC, then use the same VPC CIDR block.

Create a VPC peering connection

Complete the following steps:

1. Open the VPC console.
2. In the navigation pane, choose Peering connections.
3. Choose Create peering connection, and then configure the following:
   For Name, enter a name for the peering connection.
   For VPC ID, choose the default tenancy VPC.
   For Account, select My account.
   For AWS Region, select This AWS Region.
   For VPC ID, choose the dedicated tenancy VPC.
4. Choose Create peering connection.
5. Accept the VPC peering connection.
6. Add routes to each VPC's route table to send traffic to the other VPC through the peering connection.
   Make sure that you do the following:
   For the Target values starting with pcx-..., choose Peering Connection. Then, choose the peering connection that you created.
   For the Target value starting with igw-..., choose Internet Gateway. Then, choose the internet gateway that you created.

Example default tenancy VPC route table:

Example dedicated tenancy VPC route table:

For more information, see Create a VPC peering connection.

Create a Lambda execution role with VPC access

Note: If you already have a Lambda execution role with VPC access, then skip this section.

Complete the following steps:

1. Open the AWS Identity and Access Management (IAM) console.
2. In the navigation pane, choose Roles, and then choose Create role.
3. For Trusted entity type, choose AWS service.
4. For Use case, choose Lambda, and then choose Next.
5. Select the AWSLambdaVPCAccessExecutionRole managed policy, and then choose Next.
6. For Role name, enter a name.
7. Choose Create role.

For more information, see Working with AWS managed policies in the execution role.

Create a Lambda function

Complete the following steps:

1. Open the Lambda console.
2. In the navigation pane, choose Functions, and then choose Create function.
3. Choose Author from scratch, and then configure the following:
   For Function name, enter a name for your function.
   For Runtime, chooseNode.js 22.x
   Under Permissions, expand Change default execution role.
   Choose Use an existing role, and then select the execution role that you created in the preceding section.
4. Choose Create function.
5. Choose the Code tab, and then enter the following code:

   import http from 'http';
   
   export const handler = async (event) => {
     const options = {
       hostname: event.Host,
       port: event.Port,
     };
   
     return new Promise((resolve, reject) => {
       http.get(options, (res) => {
         resolve({ httpStatus: res.statusCode });
       }).on('error', (err) => {
         reject(new Error(err.message));
       });
     });
   };
   

   Note: You can use any supported Lambda runtime. The preceding example uses Node.js.
6. Choose Deploy.

For more information, see Building Lambda functions with Node.js.

Connect your Lambda function to the default tenancy VPC

Complete the following steps:

1. Open the Lambda console.
2. In the navigation pane, choose Functions, and then select your function.
3. Choose the Configuration tab and then choose VPC.
4. Choose Edit, and then configure the following:
   For VPC, choose the default tenancy VPC that you previously created. 
   For Subnets, choose two or more subnets in different Availability Zones.
   For Security groups, choose a security group.
   Note: The default security group is sufficient for most use cases.
5. Choose Save.

Test connectivity

Complete the following steps:

1. Launch a Dedicated Instance.
   Note: To connect to the Amazon EC2 instance later, assign a public IPv4 address during setup, or associate an Elastic IP address after launch. Your AWS account incurs charges for this instance.

2. Confirm that the network access control lists (ACLs) for both VPCs allow traffic on port 80.

3. Connect to your EC2 instance.

4. To launch an HTTP server on your EC2 instance, run the following command:

   $ sudo python3 -m http.server 80

5. In the Lambda console, configure a test event with the following JSON:

   {
   "Host": "yourHost",
   "Port": 80
   }

   Note: Replace yourHost with the private IPv4 address of your EC2 instance.

6. Choose Test.

7. Check the execution result for a 200 response code:

   {
   "httpStatus": 200
   }

A 200 response confirms that the function in the default tenancy VPC can reach resources in the dedicated tenancy VPC through the peering connection.

Note: If the function times out, then make sure that your security groups and network ACLs are configured correctly. If you get an "ECONNREFUSED" error, then make sure that the HTTP server is running on your EC2 instance.

Related information

What is VPC peering?

Best practices for working with AWS Lambda functions