VPC Peering with lambda

0

Hello, I have 2 VPCs in 2 AWS accounts having Peering configured. Currently, there is an HTTP connection from lambda to other account lambda using Lambda function URLs. How can I replace this connection with the VPC Peering connection?

3回答
2
承認された回答

Hello.

Do you mean you want to access the Lambda function URL privately from within your VPC?
In that case, as stated in the document below, only public access is possible, so this is currently not possible.
https://docs.aws.amazon.com/ja_jp/lambda/latest/dg/lambda-urls.html

You can access your function URL through the public Internet only. While Lambda functions do support AWS PrivateLink, function URLs do not.

profile picture
エキスパート
回答済み 3ヶ月前
profile picture
エキスパート
レビュー済み 2ヶ月前
1

You always invoke Lambda functions using the public Invoke API. Even if you use Function URL, it is public. This means that in order to invoke a function directly, you need to access the internet.

profile pictureAWS
エキスパート
Uri
回答済み 3ヶ月前
profile picture
エキスパート
レビュー済み 1ヶ月前
  • Thank again. For an Example, If I invoke the lambda by another lambda in the same account using the boto3 library for Python, does it still traverse through public internet?

  • Ahh may be so since lambdas run on their own VPCs?

  • You need to go outside the VPC using Lambda VPC endpoint or a NAT Gateway. It uses public IP addresses, but it remains in our backbone. It does not traverse the public internet.

1

Hi, if what you are trying to achieve is to invoke your second lambda function without using the public service endpoint, you can create a vpc interface endpoint to the Lambda service in your VPC 1 to communicate with Lambda service (to invoke other Functions). As your Lambda 1 is configured to access your vpc, you can use the aws sdk (boto3 in python) to invoke your Lambda 2 and use the created private endpoint in the lambda client creation in your code, informing the private endpoint with the endpoint_url parameter. Please take into account that invoking a Lambda function in other account using the AWS SDK, you need to use AWS STS (Security Token Service) from within your code in order to assume a role in the second account that gives you permissions to execute the second Lambda function. Additionally when using vpc endpoints, private link fees applies. Please check: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc-endpoints.html https://boto3.amazonaws.com/v1/documentation/api/latest/reference/core/session.html (check here the endpoint_url parameter) https://aws.amazon.com/privatelink/pricing/

AWS
回答済み 3ヶ月前
profile picture
エキスパート
レビュー済み 1ヶ月前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ