Connecting to white listed API from Lambda inside private subnet with NAT gateway

My goal is to have a request sent from a lambda with a static IP address. This is the current setup i have.

I have created the following:

• route table for private subnet (All traffic -> nat gateway)
• route table for public subnet (All traffic -> internet gateway)
• multiple API's inside private subnet
• ALB pointing to private subnet, with IP whitelist
• Route 53 record pointing to ALB
• lambda inside VPC, within private subnet

However when i make requests from my lambda it is getting the following error:

ERROR! HTTPSConnectionPool(host='test-api', port=443): Max retries exceeded with url: /test 
(Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f1434cb9450>: 
Failed to establish a new connection: [Errno -2] Name or service not known'))

I am able to make API requests from other API's to this 'test-api' domain with no issues (So the traffic is clearly being sent through NAT gateway) and confirmed other IP's are unable to make requests to this domain.

I also am able to make requests to outside urls (https://google.com was fine) from inside the lambda.

I looked at the ENI flow logs for this lambda and i dont see the NAT gateway IP's anywhere.

But I also confirmed an ENI was created, and the lambda is (seemingly) connected to the VPC and inside private subnets. I can see this under the 'VPC configuration' on the console.

Is there something I may be missing? It seems as though my lambda is not sending traffic through my NAT gateway and im not sure why.

    # lambda
    resource "aws_lambda_function" "this" {
      function_name = "${var.project_name}-lambda"
      role          = aws_iam_role.this.arn
      package_type  = "Image"
      timeout       = 120
      image_uri     = "${resource.aws_ecr_repository.this.repository_url}:latest"
    
      vpc_config {
        security_group_ids = [aws_security_group.this.id]
        subnet_ids         = data.aws_subnets.private.ids
      }
    
    }
    
    # security group
    resource "aws_security_group" "this" {
      name        = "${var.project_name}"
      description = "SG for data loader lambda"
      vpc_id      = one(data.aws_vpcs.main.ids)
      egress {
        from_port   = 0
        to_port     = 0
        protocol    = "-1"
        cidr_blocks = ["0.0.0.0/0"]
      }
    }
    
    # IAM for lambda
    data "aws_iam_policy_document" "assume_role_lambda" {
      statement {
        effect = "Allow"
        principals {
          type        = "Service"
          identifiers = ["lambda.amazonaws.com"]
        }
        actions = ["sts:AssumeRole"]
      }
    }
    
    resource "aws_iam_role" "this" {
      name                 = "${var.project_name}-lambda"
      assume_role_policy   = data.aws_iam_policy_document.assume_role_lambda.json
    }
    
    resource "aws_iam_policy" "lambda_vpc_access" {
      name        = "${var.project_name}-lambda-vpc-access"
      description = "Allow lambda to create, describe and delete network interfaces so that it can access VPC resources"
      policy = jsonencode({
        Version = "2012-10-17"
        Statement = [
          {
            Action = [
              "ec2:CreateNetworkInterface",
              "ec2:DescribeNetworkInterfaces",
              "ec2:DeleteNetworkInterface",
              "ec2:AssignPrivateIpAddresses",
              "ec2:UnassignPrivateIpAddresses"
            ]
            Effect   = "Allow"
            Resource = "*"
          },
          {
            Action = [
              "logs:CreateLogGroup",
              "logs:CreateLogStream",
              "logs:PutLogEvents"
            ],
            Effect   = "Allow",
            Resource = "*"
          }
        ]
      })
    }

I then call my api simply like so inside the lambda:

    import requests
    def handler(event, context):
        try:
            requests.get(
                "https://my-api.com/test"
            )
        except Exception as e:
            print("ERROR!", e)
            raise e