Does private link work for a lambda function?

user_5421539 0
Viewed 334

I have a ECS fargate container running inside a private VPC which doesn't have internet access. It needs to invoke a lambda via AWS SDK. Based on my understanding, AWS creates a default public endpoint for the lambda and when I call invokeLambda method the traffic will always go to internet. If my understanding is right, that means my Fargate container won't be able to call the lambda. Is it right?

If it is right, what is the alternative solution is? The goal is that the traffic won't go to internet in any chance.

  • Can I create a private link endpoint for my lambda?

  • Or create a API gateway with VPC endpoint which connects to lambda?

aws-api-gateway aws-lambda amazon-web-services
1 Answers

If my understanding is right, that means my Fargate container won't be able to call the lambda. Is it right?

Yes. Without NAT gateway or instance, you won't be able to directly invoke the lambda function from private subnet.

Can I create a private link endpoint for my lambda?

Sadly no. There are not VPC interface endpoints for lambda.

Or create a API gateway with VPC endpoint which connects to lambda?

Yes, this should be possible by creating private API gateway. The private API would be only accessible from within your VPC. But API gateway to lambda will still probably go over the internet.

The Security Overview of AWS Lambda whitepaper writes:

Invocations from Amazon Kinesis and DynamoDB streams, SQS queues, Application Load Balancer,and API Gateway follow the request-response path

For request-response invocations, the payload passes from the API caller—such as AWS API Gateway or the AWS SDK—to a load balancer, and then to the Lambda invoke service. This service identifies an execution environment for the function, and passes the payload to that execution environment to complete the invocation. Traffic to the load balancer passes over the internet, and is secured with TLS.

user_2488230
Related