CODEWITHSUNDEEP
amazon-web-servicesaws-cloudformationamazon-vpc
Justin808
Justin808

Reputation: 21512

How can I let my VPC have access to the internet via cloudformation?

I have a VPC setup to that my lambda function can talk to my RDS server. This is working. I also need my lambda functions to have access to the internet. To this end I'm trying to setup an internet gateway and the routes to allow it. I'm failing.

The VPC routes and gateway are created as the following

"VPC": {
  "Type": "AWS::EC2::VPC",
  "Properties": {
    "CidrBlock": "10.0.0.0/16",
    "EnableDnsSupport": "true",
    "EnableDnsHostnames": "true",
    "InstanceTenancy": "default",
    "Tags" : [{ "Key": "Name", "Value": { "Ref": "DomainName" } }]
  }
},

"VPCRouteTable" : {
   "Type" : "AWS::EC2::RouteTable",
   "Properties" : {
      "VpcId" : { "Ref" : "VPC" },
      "Tags" : [{ "Key": "Name", "Value": { "Ref": "DomainName" } }]
   }
},

"InternetGateway" : {
   "Type" : "AWS::EC2::InternetGateway",
   "Properties" : {
   "Tags" : [{ "Key": "Name", "Value": { "Ref": "DomainName" } }]
   }
},

"AttachGateway": {
   "Type" : "AWS::EC2::VPCGatewayAttachment",
   "Properties" : {
      "VpcId" : { "Ref" : "VPC" },
      "InternetGatewayId" : { "Ref" : "InternetGateway" }
   }
},

"InternetRoute" : {
   "Type" : "AWS::EC2::Route",
   "DependsOn" : "InternetGateway",
   "Properties" : {
      "RouteTableId" : { "Ref" : "VPCRouteTable" },
      "DestinationCidrBlock" : "0.0.0.0/0",
      "GatewayId" : { "Ref" : "InternetGateway" }
   }
},

I create the subnets and associate them with the route table

"SubnetA": {
  "Type": "AWS::EC2::Subnet",
  "Properties": {
    "VpcId": { "Ref": "VPC" },
    "CidrBlock": "10.0.0.0/24",
    "AvailabilityZone": { "Fn::Select": [ "0", { "Fn::GetAZs": { "Ref": "AWS::Region" } }]},
    "Tags" : [{ "Key": "Name", "Value": { "Ref": "DomainName" } }]
  }
},

"SubnetB": {
  "Type": "AWS::EC2::Subnet",
  "Properties": {
    "VpcId": { "Ref": "VPC" },
    "CidrBlock": "10.0.1.0/24",
    "AvailabilityZone": { "Fn::Select": [ "1", { "Fn::GetAZs": { "Ref": "AWS::Region" } }]},
    "Tags" : [{ "Key": "Name", "Value": { "Ref": "DomainName" } }]
  }
},

"SubnetARouteTableAssociation" : {
   "Type" : "AWS::EC2::SubnetRouteTableAssociation",
   "Properties" : {
      "SubnetId" : { "Ref" : "SubnetA" },
      "RouteTableId" : { "Ref" : "VPCRouteTable" }
   }
},

"SubnetBRouteTableAssociation" : {
   "Type" : "AWS::EC2::SubnetRouteTableAssociation",
   "Properties" : {
      "SubnetId" : { "Ref" : "SubnetB" },
      "RouteTableId" : { "Ref" : "VPCRouteTable" }
   }
},

I have the database security groups

"DBSubnetGroup": {
  "Type": "AWS::RDS::DBSubnetGroup",
  "Properties": {
    "DBSubnetGroupDescription": "Database Access",
    "SubnetIds" : [{ "Ref": "SubnetA" }, { "Ref": "SubnetB" }],
    "Tags" : [{ "Key": "Name", "Value": { "Ref": "DomainName" } }]
  }
},

"DBEC2SecurityGroup": {
  "Type": "AWS::EC2::SecurityGroup",
  "Properties": {
    "GroupDescription": "Security group for RDS DB Instance",
    "VpcId": {"Ref": "VPC"},
    "SecurityGroupIngress" : [{
      "IpProtocol": "tcp",
      "FromPort": "3306",
      "ToPort": "3306",
      "CidrIp": "10.0.0.0/16"
    }],
    "Tags" : [{ "Key": "Name", "Value": { "Ref": "DomainName" } }]
  }
},

and the lambda security group

"LambdaSecurityGroup": {
  "Type": "AWS::EC2::SecurityGroup",
  "Properties": {
    "GroupDescription": "Security group for Lambda",
    "VpcId": {"Ref": "VPC"},
    "Tags" : [{ "Key": "Name", "Value": { "Ref": "DomainName" } }]
  }
},

So As it stands now, my lambda's can talk to the database just fine. but they can't reach the internet. What am I missing?

Upvotes: 0

Views: 300

Answers (1)

Vor
Vor

Reputation: 35099

If your lambda function needs to have access to both your VPC resources and Internet, then create 2 subnets: public and private. Put your lambda in private subnet and configure NAT in public subnet.

From http://docs.aws.amazon.com/lambda/latest/dg/vpc.html

Therefore, if your Lambda function requires Internet access (for example, to access AWS services that don't have VPC endpoints, such as Amazon Kinesis), you can configure a NAT instance inside your VPC or you can use the Amazon VPC NAT gateway. For more information, see NAT Gateways in the Amazon VPC User Guide.

Upvotes: 1

Related Questions