8

Is it possible to place an aws lambda in a public subnet and thus avoid paying for NAT?

The docs state the following

If your Lambda function needs Internet access, do not attach it to a public subnet or to a private subnet without Internet access. Instead, attach it only to private subnets with Internet access through a NAT instance or an Amazon VPC NAT gateway.

But do not explain why we can not attach the lambda to a public subnet.

2

2 Answers 2

5

No, it's not possible to place an AWS Lambda in a public subnet and thus avoid paying for NAT. Lambda functions cannot have public IPs so they cannot route to the internet without a NAT (gateway or instance).

Put them in a private subnet, ensure the private subnet's default route is a NAT in a public subnet, that the NAT has a public IP, and that the VPC has an IGW.

For more, see this Stack Overflow question.

2

Provided the Public Subnet where you're launching your Lambda is configured with Auto-assign public IPv4 address: Yes it should work in public a subnet without NAT.

Whether or not it's a good idea is another question. In general you shouldn't launch any backend services in the public subnets, the public subnets are for things like API Gateways, NAT Gateways, Load Balancers, etc. Not for launching the actual backend systems. That's the best security practice.

However that aside I'm pretty confident that with auto-assign IPv4 address enabled Lambdas will work even in the public subnet.

Unless you want the Lambda to connect to any VPC-internal resources (e.g. to your RDS) you may just as well launch it without VPC config (leave those VPC and Subnet settings empty). That will give it access to the internet without having to worry about NAT or public IPs.

Hope that helps

3
  • I tried configuring the lambda to be in a public subnet with Auto-assign public IPv4 address: Yes but I don't think it was able to connect to the internet. The public subnet also has an IGW at 0.0.0.0/0 in the routing table.
    – Leo Lei
    Commented Oct 28, 2018 at 14:33
  • @LeoLei here's some checklist items... 1 check the VPC network ACL (ensure inbound & outbound is enabled for TCP over port 443 (https)) ,, 2 check the Lambda security group, ensure outbound TCP over port 443 is enabled ,, 3 check the VPC route table, ensure a default route to the IGW is available
    – sudo soul
    Commented Apr 8, 2019 at 21:52
  • No, Lambda functions do not get a public IP, regardless of the auto-assign IPv4 address setting. They cannot have public IPs. To reach the internet, they must route through a NAT (which routes to an IGW).
    – jarmod
    Commented Dec 12, 2019 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.