AWS Lambda: How do I connect to a service that uses IP whitelisting from AWS Lambda?

user_14570282 0
Viewed 393

We're working with a third-party web service that only allows connections from whitelisted IP addresses. So far, we've provisioned AWS Elastic IPs for our EC2 instances and had those IP addresses whitelisted by the provider.

As we start to migrate parts of our application workload to AWS Lambda, how should we deal with this? I'm envisioning we may have to setup some sort of a proxy server, but I'm unsure if AWS provides a turnkey solution or whether we'll need to hack together something with SSH forwarding / SOCKS proxy via an EC2 instance, or some other method.

aws-lambda amazon-web-services ssh proxy
2 Answers

To do this you should use VPC configuration within your Lambda, configuring it within private subnets.

Once it is in these subnets it will only be able to communicate outbound using a NAT. Create either a NAT Gateway or NAT instance (with an EIP attached to it), then configure your route tables for the subnet(s) the Lambda is in to use this (for high availability use one per AZ).

As each of these NATs has an EIP attached these IP addresses can now be given for whitelisting, this approach allows only your resources to be whitelisted.

user_134609330

You can have your Lambda function associated with a VPC, it can then connects via an Elastic Network Interface (ENI). It is possible to attach an EIP to an ENI. OR Static IP of NAT Gateway associated with the VPC.

user_71525580
Related