How do I troubleshoot Lambda HTTP 500 and HTTP 502 status code errors?

Resolution

Identify the specific Lambda invoke API error that you receive. Then, follow the troubleshooting steps for that error.

Note: For a list of errors and descriptions, see Errors in the Lambda invoke API reference.

"InvalidRuntimeException"

Lambda doesn't support the specified runtime or runtime version. Configure your Lambda function memory to use the correct Lambda runtime for your function code.

"InvalidSecurityGroupIDException"

Confirm that you specified the correct Amazon Virtual Private Cloud (Amazon VPC) security group ID in your Lambda function configuration. For more information, see Giving Lambda functions access to resources in an Amazon VPC.

"InvalidZipFileException"

Confirm that Lambda has permissions to unzip the deployment package. For more information, see How do I troubleshoot Lambda "permission denied" or "unable to import module" errors when uploading a deployment package?

Also, confirm that you created the deployment package file correctly. For more information, see Deploying Lambda functions as .zip file archives.

"KMSAccessDeniedException"

Check your Lambda function's AWS Identity and Access Management (IAM) permissions and your AWS Key Management Service (AWS KMS) key policies.

The "KMSAccessDeniedException" error usually occurs when you delete a Lambda function's IAM role and then recreate it with the same name. If this happened, then configure a new IAM role for the function. Redeploy the function and reconfigure the preceding IAM role.

For more information, see Key policies in AWS KMS.

Note: The IAM user who creates and updates the Lambda function must have permission to use the AWS KMS key.

"KMSDisabledException"

Lambda couldn't perform decryption because the AWS KMS key is deactivated. To resolve this error, activate the AWS KMS key.

"KMSInvalidStateException"

Your AWS KMS key isn't in a valid state for AWS KMS Decrypt API requests. Verify that the AWS key is activated.

For more information, see Key states of AWS KMS keys.

"KMSNotFoundException"

The AWS KMS key specified in your request must be in the same AWS Region and AWS account as your Lambda function. If the AWS Region is different, then use another AWS KMS key or create a new AWS KMS key in the same Region.

"ResourceNotReadyException"

Lambda reclaims network interfaces that aren't in use and might place a function in an inactive state. When you invoke an inactive function, it enters a pending state while Lambda restores VPC network access. The first invocation and all others that occur while the function is in a pending state fail and then return a "ResourceNotReadyException" error.

To resolve the error, wait until Lambda restores the VPC connection. Then, invoke the Lambda function again.

"ServiceException"

The Lambda service encountered an internal error. Check the AWS Health Dashboard to confirm if Lambda is unavailable. For more information, see Is AWS down?

If Lambda is available, then retry the request to invoke your Lambda function.

"SubnetIPAddressLimitReachedException"

The CIDR block defines a subnet's size. Be sure that the CIDR blocks that you specify in your Amazon VPC have enough free IP addresses for your Amazon VPC-activated Lambda function's requirements. For more information, see VPCs and subnets.

"You have exceeded the maximum limit for Hyperplane elastic network interfaces for your account"

The default quota limit for network interfaces for Amazon VPC is 500. If you determine that you require a higher service quota for Hyperplane network interfaces, then request a quota increase.