By using AWS re:Post, you agree to the AWS re:Post Terms of Use

How do I use AWS Systems Manager to troubleshoot internet access issues for an AWS Lambda function that's in an Amazon VPC?

2 minute read
0

I granted internet access to my AWS Lambda function that's in an Amazon Virtual Private Cloud (Amazon VPC). Now, the function loses internet access or times out.

Short description

Verify that the following resources allow outbound internet access to your Lambda function:

If any of the preceding resources don't grant internet access to your Lambda function, then reconfigure the resource to grant your function internet access.

To manually review the resources, see How do I give internet access to a Lambda function that's connected to an Amazon VPC? To automate the troubleshooting process, use the AWSSupport-TroubleshootLambdaInternetAccess AWS Systems Manager runbook.

Resolution

To use the AWSSupport-TroubleshootLambdaInternetAccess runbook, complete the following steps:

  1. Open the Systems Manager console.
  2. In the left navigation pane, under Change Management, choose Automation.
  3. Choose Execute automation.
  4. Choose the Owned by Amazon tab, and then search for AWSSupport-TroubleshootLambdaInternetAccess.
  5. Choose the icon for the AWSSupport-TroubleshootLambdaInternetAccess card.
    Note: Don't choose the name of the automation.
  6. Choose Next.
  7. (Optional) In the Input parameters section, for AutomationAssumeRole, enter the ARN of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform actions. If an IAM role isn't specified, then Systems Manager Automation uses the permissions of the IAM user role that runs the document. For more information, see Use IAM to configure roles for Automation.
    Important: Either the AutomationAssumeRole or user role must have permissions for the following actions:
    GetFunction
    DescribeRouteTables
    DescribeNatGateways
    DescribeSecurityGroups
    DescribeNetworkAcls
  8. For FunctionName, enter the name of the function.
  9. For destinationIp, enter the destination IP address where you want to initiate outbound internet access.
  10. For destinationPort, enter the destination port where you want to initiate outbound internet access.
  11. Choose Execute.

The runbook's output provides the status of each resource that might cause the loss of internet connectivity for your Lambda function. The output also provides recommendations for how to resolve the issue as an "Analysis" message.

Note: For more information about AWS System Manager automation runbooks, see Creating your own runbooks.