0

When I attempt to create a VPC Endpoint for the com.amazonaws.us-east-1.lambda (lambda service), the "us-east-1a" Availability Zone is not an option. However, when I choose a different service, like "com.amazonaws.us-east-1.rds", I can choose a subnet in the "us-east-1a" Availability Zone.

I am creating VPC endpoints via CloudFormation template, but also confirmed this occurs when creating via the UI.

I have been reviewing AWS documentation and also previous questions, but I cannot determine why this is occurring and how to fix this so we can select the subnets in that AZ for that VPC endpoint. Any guidance is appreciated.

Screenshot of attempting to create VPC endpoint for lambda with us-east-1a not allowed: screenshot-lambda-vpc-endpoint

Screenshot of attempting to create VPC endpoint for another service: screenshot-rds-vpc-endpoint

Coogie7
  • 189
  • 1
  • 11

1 Answers1

2

You can run the CLI command to check for a service and the Availability Zones which are available to use for creating a VPC endpoint.

aws ec2 describe-vpc-endpoint-services --service-names SERVICE-NAME

Example for Lambda:

aws ec2 describe-vpc-endpoint-services --service-names com.amazonaws.us-east-1.lambda

{
    "ServiceDetails": [
        {
            "ServiceName": "com.amazonaws.us-east-1.lambda",
            "AvailabilityZones": [
                "us-east-1a",
                "us-east-1b",
                "us-east-1c"
            ]....}

Why can’t I select an Availability Zone for my Amazon VPC interface endpoint? https://aws.amazon.com/premiumsupport/knowledge-center/interface-endpoint-availability-zone/

Shivam
  • 161
  • 3
  • Hi Shivam, that is one of the articles I've reviewed. I ran the command for the lambda service, and the Availability Zone are us-east-1b, us-east-1c, and us-east-1d. Why not the first AZ, us-east-1a? That seems off. – Coogie7 Jul 15 '21 at 17:10
  • AZ mapping differs across accounts(also mentioned in the article), so the AZs us-east-1b, us-east-1c, and us-east-1d as per your account would be pointing to the ones where the service can be used. – Shivam Jul 15 '21 at 17:18
  • That part of the article came across to me as talking about which subnets are associated with which AZs, not whether a service is available in an AZ. – Coogie7 Jul 15 '21 at 17:26