AWS Lambda to on-premise via direct connect and AWS PrivateLink?



I'd like to understand if traffic from AWS Lambda functions to an on-premise environment is allowed, if the functions are placed outside the VPC but leveraging AWS PrivateLink with an Lambda Endpoint? (see image below)

I believe from on-premise to Lambda is possible but i'm looking for confirmation if the other way around is possible.

Enter image description here

Thanks for any thoughts in advance.

1 Answer
Accepted Answer

Hi Mart,

I understand you are looking to connect your Lambda functions to your on-premises environment that is connected to your VPC via Direct Connect, as follows:

Lambda -> VPC -> DX -> on-premises environment

And you would like to know if using PrivateLink is required so the Lamba function uses a Lambda endpoint to connect to your VPC, then DX, then on-premises. Please, let me know if my assumption is incorrect.

Do note that Lambda endpoints are inbound endpoints meaning you use them to call your Lambda functions without using the internet hence all your traffic remains private, as in:

HTTP client -> Lambda endpoint -> Lambda service -> Lambda function

So Lambda endpoints are not outbound endpoints.

From a networking perspective, all Lambda functions (whether yours or other’s) are located, or deployed, inside Lambda service’s VPC. In order for your Lambda function to access your own VPC, what’s happening under the hood is that the Lambda service is using PrivateLink to connect its own service VPC to your own VPC, as in:

Lambda service VPC -> PrivateLink -> your own VPC -> resources hosted in your VPC

Therefore, once you have configured your Lambda to be deployed (or connected) to your VPC [1], as long as your VPC has connectivity to your data center, it will be allowed to route the traffic towards it - whether it uses Direct Connect or other connections, like VPN.

In case my answer doesn’t address your question or you have any follow-up, please let me know.

Hope it helps,



[1] Configuring a Lambda function to access resources in a VPC -

profile pictureAWS
answered a year ago
profile pictureAWS
reviewed a year ago
profile pictureAWS
reviewed a year ago
  • Hi Rocky,

    I appreciate your in-depth answer and thanks for taking the time to follow-up.

    I think its most clear, and we'll take this into consideration for our next architectural decicions.


You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions