CODEWITHSUNDEEP
amazon-ec2aws-lambdaboto3amazon-vpc
museshad
museshad

Reputation: 498

VPC-enabled Lambda function cannot launch/access EC2 in the same VPC

I have a VPC enabled Lambda function which attempts to launch an EC2 using a launch template. The EC2 launch step (run_instances) fails with the below generic network error.

Calling the invoke API action failed with this message: Network Error

I can launch an instance successfully directly from the launch template, so I think everything is fine with the launch template. I have configured the following in the launch template

The Lambda function includes the below code-

import json
import boto3
import time

def lambda_handler(event, context):
    ec2_cl = boto3.client('ec2')
    launch_temp = {"LaunchTemplateId": "<<Launch Template ID>>"}
    resp_ec2_launch = ec2_cl.run_instances(MaxCount=1, MinCount=1, LaunchTemplate=launch_temp, SubnetId="<<Subnet ID>>")

Few things on the Lambda function-

The error is a network error, so I assume all is fine (atleast as of now) with the privileges granted to the IAM role. I'm sure there would be a different error, if the IAM role missed any policies.

Can someone indicate what I might be missing?

Upvotes: 0

Views: 1811

Answers (2)

John Rotenstein
John Rotenstein

Reputation: 270089

It appears that your VPC does not have an Internet Gateway, but it does have a VPC Endpoint for EC2.

Therefore, to try and reproduce your situation, I did the following:

  • Created a new VPC with one subnet but no Internet Gateway
  • Added a VPC Endpoint for EC2 to the subnet
  • Created a Lambda function that would call DescribeInstances() and attached the Lambda function to the subnet
  • Opened the security group on the VPC Endpoint and Lambda function to allow all traffic from anywhere (hey, it's just a test!)

My Lambda function:

import json
import boto3

def lambda_handler(event, context):
    ec2 = boto3.client('ec2',region_name='ap-southeast-2')
    print(ec2.describe_instances())

The result: The Lambda function successfully received a response from EC2, with a list of instances in the region. No code or changes were required.

Upvotes: 1

John Rotenstein
John Rotenstein

Reputation: 270089

It appears that the problem is with your AWS Lambda function being able to reach the Internet, since the Amazon EC2 API endpoint is on the Internet.

If a Lambda function is not attached to a VPC, it has automatic access to the Internet.

If a Lambda function is attached to a VPC and requires Internet access, then the configuration should be:

  • Attach the Lambda function only to private subnet(s)
  • Launch a NAT Gateway in a public subnet
  • Configure the Route Table on the private subnets to send Internet-bound traffic (0.0.0.0/0) through the NAT Gateway

Upvotes: 2

Related Questions