Lambda Function Cannot Connect to EC2 Instance in the Same Subnet Despite Identical Security Groups

The documentation statement "You cannot route traffic between hosts in the same subnet through an appliance" [1] applies to standard EC2 instances but does not apply to Lambda functions.

Why EC2-to-EC2 works (same subnet):

Traffic between two EC2 ENIs in the same subnet is delivered at Layer 2 (data link layer). The VPC fabric delivers the packet directly to the destination ENI based on its MAC address without consulting the subnet route table. This is why same-subnet EC2 traffic bypasses appliance routes entirely, the route table is never evaluated for same-subnet delivery.

Why Lambda-to-EC2 fails (same subnet):

Lambda functions do not execute inside your VPC. A Lambda function runs in a VPC owned by the Lambda service [2]. It accesses your VPC resources through a Hyperplane ENI (also called a cross-account ENI), which is a network interface attached to your subnet on behalf of the Lambda service. The Lambda execution environment establishes a network tunnel to this Hyperplane ENI to reach resources in your VPC [3].

Because the traffic arrives at your VPC via a tunnel through the Hyperplane ENI (not from a locally-resident instance), it does evaluate the subnet route table even for same-subnet destinations. If your route table has a more-specific route overriding the local route (e.g., the VPC CIDR pointing to a TGW ENI or appliance), Lambda traffic will match that route and be sent to the inspection path.

Summary:

Source	Behaviour	Route table evaluated?
EC2 instance (same subnet)	Layer 2 direct delivery	No
Lambda function (same subnet)	Tunnelled via Hyperplane ENI	Yes

What this means for inspection architectures:

If you use a centralized inspection pattern where a more-specific route overrides the VPC local route (East-West inspection), Lambda traffic to same-subnet destinations will traverse the inspection path while EC2 traffic will not. This is expected behaviour.

Troubleshooting steps if Lambda traffic fails through the inspection path:

1. Verify the firewall policy permits traffic from the Lambda ENI source IP to the destination. Lambda ENIs are ephemeral, the source IP may change between invocations. Use CIDR-based rules (the full subnet range) rather than specific IP-based rules.

2. Verify appliance mode is enabled on the TGW VPC attachment for the inspection VPC. Without appliance mode, the forward path (SYN) and return path (SYN-ACK) may traverse different AZs, causing a stateful firewall to drop the SYN-ACK as it has no matching session state.

3. Check the firewall logs for deny entries matching the Lambda source IP and destination port.

References:

• [1] Appliance routing considerations
• [2] Configuring Lambda for VPC access
• [3] Improved VPC networking for Lambda functions
• [4] Gateway Load Balancer centralized inspection
• [5] Transit Gateway appliance mode