AWS: Lambda, VPC and endpoints for SecretManager and AppConfig

Question

We have a Lambda who needs to be connected to an VPC in order to mount an EFS volume.

This lambda needs too connect to AWS SecretManager and AWS AppConfig.

To reach AWS secret manager we create a endpoint (interface type) to the service called "com.amazonaws.eu-west-1.secretsmanager"

But we can't find any service for AWS AppConfig into the endpoints list and we think is not available at this time.

Any idea?

Answer 1

You are correct, there is no VPC interface endpoint for AWS AppConfig (AC). However, AC is part of AWS Systems Manager (SSM), thus maybe you can try with interface endpoint for SSM.

If it does not work, and probably it wont, then an alternative is to place your function in a private subnet and setup NAT gateway/instance in a public subnet. This way your function will be able to access a public endpoint of the AC over the internet.

If this is not a good solution, then you can create a second lambda, not in a VPC. The second lambda will act as a proxy, so that the first lambda in a VPC can interact with AC using the second lambda. Lambda has VPC interface endpoint, thus there is no need for internet connection in a VPC.