Lambda Function URL in a public subnet?

Question

Note: I am NOT asking why a Lambda in a subnet cannot access the public internet.

I would like to host a Lambda function, with the Function URL enabled, in a public subnet and expose it via CloudFront. This is so that the function can be called from the broader internet but also access private resources.

Is this possible?

I have tried creating a very simple Lambda (the default generated by the serverless.AspNetCoreMinimalAPI template) and uploading to a simple function with Function URL enabled. With just that, I can call the Lambda from (eg) Postman.

The moment I attach it to the public subnet of my VPC I get 502 Bad gateway even with an Internet Gateway attached to the VPC.

Tibic4 · Answer

Yes, it is possible. You need to add a NAT Gateway to your VPC and attach it to your public subnet. Then you need to add a route to your route table to route all traffic to the NAT Gateway. You can find more information here: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html

Mohamed TAIEB · Answer

You can use an API gateway in front of your Lambda, and keep all your ressources in private subnet (to keep them fully secured). You'll no longer need a public url for your lambda, the api gateway has mapping routes, so you can use them. You may add a cloudFront to the api gateway, only if you need to expose other static contents or api's. If not, you can use a Route53 - a custom domain name - attached to your api gateway. And it'll be fully enough

Lambda Function URL in a public subnet?

2 Answers