1

I have a Lambda running within a VPC which accesses secure resources (ex: RDS), but I also need it to publish an SNS notification. Is there a way to do this without having a NAT gateway?

Alternatively, I'm thinking of writing to a DynamoDB table which triggers another lambda but wanted to know if there's a simpler approach.

sharath.g
  • 311
  • 5
  • 17
  • We cant use redis&dynamoDb together without configuring NAT gateway. – Abdul Manaf Feb 20 '18 at 05:02
  • Just realised that DynamoDB also requires internet access, so my lambda within a VPC cannot access DynamoDB. But for this, instead of configuring NAT gateway we can open up a VPC endpoint for DynamoDB so that my lambda can access it. I wish there was a VPC endpoint to access SNS as well. Ref: https://aws.amazon.com/blogs/aws/new-vpc-endpoints-for-dynamodb/ – sharath.g Feb 20 '18 at 05:09
  • Possible duplicate of [How to let AWS lambda in a VPC to publish SNS notification?](https://stackoverflow.com/questions/35999181/how-to-let-aws-lambda-in-a-vpc-to-publish-sns-notification) – Yeshodhan Kulkarni Feb 20 '18 at 05:21

2 Answers2

0

The simple answer is no. SNS is not currently available as a VPC endpoint so you will need to continue doing what you are already doing in order to reach RDS via lambda (NAT gateway in the private subnet).

In other words, this answer from 2016 is still relevant today -> How to let AWS lambda in a VPC to publish SNS notification?

Usman Mutawakil
  • 4,993
  • 9
  • 43
  • 80
-1

Option A: using a NAT gateway Your lambda is in a private subnet which means it cannot have communication with the outside world (the internet), so unless you make that a public subnet, which is of course not recommended, you cannot access the outside world. A NAT gateway allows your resources to have that access through it, and it's really not that hard to implement. Here's a handy tutorial on how to do that: https://github.com/naguibihab/aws-goodies/blob/master/how-to-setup-lambda-to-talk-to-internet-and-vpc.md

Option B: using a NAT instance Similar to using a NAT gateway, you can also use a NAT instance which requires a bit more administration and might have less availability but it can also be cheaper. A NAT instance works in the same way as a NAT gateway, it needs to sit in a public subnet and any lambda functions in the private subnet can access the internet through it.

As for your DynamoDB alternative, you can create a VPC Endpoint for Dynamo db as Khalid T suggested: https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints-ddb.html

Edit I have been corrected, edited my answer.

Naguib Ihab
  • 4,259
  • 7
  • 44
  • 80
  • 1
    It's true that you currently need a NAT Gateway to access SNS in a VPC but this is not required for DynamoDB access. You can create a [VPC Endpoint for DynamoDB](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints-ddb.html). – Khalid T. Feb 20 '18 at 08:22
  • 2
    It is also possible to use a NAT *instance* at a significantly lower cost than a NAT Gateway. – Michael - sqlbot Feb 20 '18 at 09:12