AWS Lambda not reaching SSM service with VPC Endpoint

user_3169147 0
Viewed 513

I configured my environment with this link: https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.html

I have my VPC, with a subnet of lambdas. The security Group and NACL are all Open. I configured all VPC Endpoints that the links service shows: ssm, ec2messages, ec2, s3, even tried the ssmmessages and kms.

But when the line code says

 ssm.getParameter()...

The process timeouts 30 seconds without response. I attached a Nat Gateway and it worked, but I don't want to work with NAT Gateway.

In the link, it doesn't say that I need to configure the SSM endpoint with private DNS. I don't want that because my VPC has other projects. I tested turning on the Private DNS and my lambda also worked.

Why the Endpoint doesn't work with the Private DNS off?

This link https://purple.telstra.com.au/blog/ssm-endpoints-a-how-to

Says that if I want the Private DNS turned off I need SSM Agent, but this is to EC2 instances. What can I do with Lambdas?

amazon-vpc aws-lambda amazon-web-services amazon-ec2
2 Answers

The solution by @jarmod worked.

 const vpcEndpointHostname = 'vpce-11a2ef262s52afaba1-jeaar2sa.ssm.us-east-1.vpce.amazonaws.com';
 const endpoint = new aws.Endpoint(vpcEndpointHostname);
 const ssm = new aws.SSM({endpoint: ep});                
    
 const { Parameter } = await ssm.getParameter({
        Name: parameterName, WithDecryption: true
    }).promise();
user_31691470

Lambda functions within an Amazon VPC don't have internet access. The network interfaces that Lambda creates within an Amazon VPC have private IP addresses, and can't use an internet gateway to gain internet access. This configuration blocks the function from accessing other AWS resources outside of the Amazon VPC, such as Parameter Store.

you can follow this blog here

user_103886830
Related