Troubleshoot networking issues in Lambda - Amazon Lambda
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Troubleshoot networking issues in Lambda

By default, Lambda runs your functions in an internal virtual private cloud (VPC) with connectivity to Amazon services and the internet. To access local network resources, you can configure your function to connect to a VPC in your account. When you use this feature, you manage the function's internet access and network connectivity with Amazon Virtual Private Cloud (Amazon VPC) resources.

Network connectivity errors can result from issues with your VPC's routing configuration, security group rules, Amazon Identity and Access Management (IAM) role permissions, or network address translation (NAT), or from the availability of resources such as IP addresses or network interfaces. Depending on the issue, you might see a specific error or timeout if a request can't reach its destination.

VPC: Function loses internet access or times out

Issue: Your Lambda function loses internet access after connecting to a VPC.

Error: Error: connect ETIMEDOUT

Error: Error: Task timed out after 10.00 seconds

Error: ReadTimeoutError: Read timed out. (read timeout=15)

When you connect a function to a VPC, all outbound requests go through the VPC. To connect to the internet, configure your VPC to send outbound traffic from the function's subnet to a NAT gateway in a public subnet. For more information and sample VPC configurations, see Enable internet access for VPC-connected Lambda functions.

If some of your TCP connections are timing out, this may be due to packet fragmentation. Lambda functions cannot handle incoming fragmented TCP requests, since Lambda does not support IP fragmentation for TCP or ICMP.

VPC: Function needs access to Amazon services without using the internet

Issue: Your Lambda function needs access to Amazon services without using the internet.

To connect a function to Amazon services from a private subnet with no internet access, use VPC endpoints.

VPC: Elastic network interface limit reached

Error: ENILimitReachedException: The elastic network interface limit was reached for the function's VPC.

When you connect a Lambda function to a VPC, Lambda creates an elastic network interface for each combination of subnet and security group attached to the function. The default service quota is 250 network interfaces per VPC. To request a quota increase, use the Service Quotas console.

EC2: Elastic network interface with type of "lambda"

Error Code: Client.OperationNotPermitted

Error message: The security group can not be modified for this type of interface

You will receive this error if you attempt to modify an elastic network interface (ENI) that is managed by Lambda. The ModifyNetworkInterfaceAttribute is not included in the Lambda API for update operations on elastic network interfaces created by Lambda.