Cognito Lambda trigger socket timeout

Question

I have a Lambda trigger on my cognito resource for the presignup trigger.

I am following this example https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-sign-up.html#aws-lambda-triggers-pre-registration-example

I am getting a socket timeout and not finding much documentation on this

{
    "err": {
        "code": "UnexpectedLambdaException",
        "name": "UnexpectedLambdaException",
        "message": "arn:aws:lambda:region-arn:function:confirm failed with error Socket timeout while invoking Lambda function."
    }
}

My resources are defined as so:

"ConfirmPermission" : {
    "Type" : "AWS::Lambda::Permission",
    "Properties" : {
        "Action" : "lambda:InvokeFunction",
        "FunctionName" : { "Fn::GetAtt" : [ "confirm", "Arn" ] },
        "Principal" : "cognito-idp.amazonaws.com",
        "SourceArn" : { "Fn::GetAtt" : [ "Auth", "Arn" ] }
        }
},
"confirm" : {
    "Type": "AWS::Serverless::Function",
    "Properties": {
        "Handler": "index.confirm",
        "Runtime": "nodejs8.10",
        "CodeUri": "./src",
        "FunctionName": "confirm",
        "ReservedConcurrentExecutions" : 15,
        "Timeout": 50,
        "Role": "arn:aws:iam::arn:role/lambda-vpc-role"
    }
},
"AuthApp" : {
    "Type" : "AWS::Cognito::UserPoolClient",
    "Properties" : {
        "UserPoolId" : {"Ref" : "Auth"}
    }
},
"Auth" : {
    "Type" : "AWS::Cognito::UserPool",
    "Properties": {
        "LambdaConfig" : {
            "PreSignUp" :  { "Fn::GetAtt" : [ "confirm", "Arn" ] }
        },
        "Schema" : [
            {
                "AttributeDataType": "String",
                "Name": "email",
                "Mutable": true,
                "Required": true
            },
            {
                "AttributeDataType": "String",
                "Name": "family_name",
                "Mutable": true,
                "Required": true
            },
            {
                "AttributeDataType": "String",
                "Name": "given_name",
                "Mutable": true,
                "Required": true
            }
        ],
        "UsernameAttributes": ["email"]
    }
}

Lambda Functions:

index.js

let signIn = require('Auth/Auth.js');
exports.signIn = signIn.signIn;
exports.signUp = signIn.signUp;
exports.confirm = signIn.confirm;

sign up / confirm

exports.signUp = async (event, context) => {
    var body = JSON.parse(event.body);
    var emailAttribute = {
        Name : 'email',
        Value: body.email
    };
    var firstNameAttribute = {
        Name: 'given_name',
        Value: body.firstName
    };
    var lastNameAttribute = {
        Name: 'family_name',
        Value: body.lastName
    };

    var attributeList = [emailAttribute, firstNameAttribute, lastNameAttribute];
    try {
        var cognitoUser = await cognitoSignUp(body, attributeList);
        return {
            statusCode : 200,
            body : JSON.stringify({res : cognitoUser})
        };
    } catch(e) {
        return {
            statusCode : 500,
            body : JSON.stringify({err : e})
        };
    }
}

exports.confirm = (event, context, callback) => {
    event.response.autoConfirmUser = true;
    callback(null, event);
    return;
}

var cognitoSignUp = (body, attributeList) => new Promise((acc, rej) => {
    userPool.signUp(body.email, body.password, attributeList, null, function(err, res) {
        if (err) {
            console.log('ERROR');
            console.log(err);
            rej(err);
        } else {
            console.log('SUCCSSS');
            acc(res);
        }
    });
});

Any idea on what is causing this?

Answer 1

As it turns out, it's because the confirm function has an IAM role for aws resources which blocks network requests. I don't need the IAM role on this function. After removing it, it works perfectly. If you do need resource access, then you have to use a nat gateway

See more here:

AWS Lambda can't call Cognito Identity - IAM Role

https://gist.github.com/reggi/dc5f2620b7b4f515e68e46255ac042a7