Search code examples
amazon-web-servicesaws-lambdaamazon-ecsamazon-vpc

Accessing ECS container from AWS Lambda running in VPC


I have a lambda function in a public VPC (no NAT Gateway), which is supposed to call another ECS service, which is publicly accessible via a Load Balancer. As the lambda function does not have internet access, it can not access the ECS service. Can I somehow use internal networking (specifically the existing load balancer) so that I do not need to setup a NAT Gateway? Everything is deployed to the same public subnet.


Solution

  • If everything is deployed to the public subnet (or even in different one's but in the same vpc), you can simply create a new "Internal" load balancer. There are 2 kinds of load balancers:

    1. Public
    2. Internal

    This internal load balancer will then be available to be used by your lambda function (over a private ip, resolved through a DNS provided by the LB). (The assumption is that your current load balancer is a public one, who's DNS resolves to public IPs.) I am not aware of any way that a public load balancer be accessed by a private IP.

    However, at this point, I would ask a seemingly unrelated question, but probably important design question: What forces you to put your lambda function within a public subnet in a VPC? A lambda function will never have a Public IP, which means it can never access the internet without a NAT gateway, regardless of where it is placed. An interesting follow up question would be, what prevents you to put your lambda function outside the VPC, where it would have open access to the internets? :)