1

Is it possible to place an aws lambda in a public subnet and thus avoid paying for NAT?

The docs state the following

If your Lambda function needs Internet access, do not attach it to a public subnet or to a private subnet without Internet access. Instead, attach it only to private subnets with Internet access through a NAT instance or an Amazon VPC NAT gateway.

But do not explain why we can not attach the lambda to a public subnet.

2

Provided the Public Subnet where you're launching your Lambda is configured with Auto-assign public IPv4 address: Yes it should work in public a subnet without NAT.

Whether or not it's a good idea is another question. In general you shouldn't launch any backend services in the public subnets, the public subnets are for things like API Gateways, NAT Gateways, Load Balancers, etc. Not for launching the actual backend systems. That's the best security practice.

However that aside I'm pretty confident that with auto-assign IPv4 address enabled Lambdas will work even in the public subnet.

Unless you want the Lambda to connect to any VPC-internal resources (e.g. to your RDS) you may just as well launch it without VPC config (leave those VPC and Subnet settings empty). That will give it access to the internet without having to worry about NAT or public IPs.

Hope that helps

  • I tried configuring the lambda to be in a public subnet with Auto-assign public IPv4 address: Yes but I don't think it was able to connect to the internet. The public subnet also has an IGW at 0.0.0.0/0 in the routing table. – Leo Lei Oct 28 '18 at 14:33
  • @LeoLei here's some checklist items... 1 check the VPC network ACL (ensure inbound & outbound is enabled for TCP over port 443 (https)) ,, 2 check the Lambda security group, ensure outbound TCP over port 443 is enabled ,, 3 check the VPC route table, ensure a default route to the IGW is available – sudo soul Apr 8 at 21:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.