Task timed out when connecting documentdb through pymongo in aws lambda

Question

I'm trying to fetch my bookings collection from AWS Document db cluster. I've maintained the credentials using AWS Secret Manager and passing them to connect. However, it gives me a Task Timed Out Error of 900 seconds. (I increased the time limit to 15 mins since it gave the same error with lesser duration)

The error is as such:

{ "errorMessage": "2021-08-19T09:05:22.872Z a96e95cb-4c42-4880-b339-9cb29e83c1ec Task timed out after 900.10 seconds" }

Code snippet:

def lambda_handler(event, context): 
    
    db = create_mongo_connection()
    print(db)
    print("aaaaa")                    # this gets printed -- debugging 
    bookings = db.bookings.find({})   # bookings collection not fetched
    print("bbbbb")                    # this does not get printed -- debugging 

#configuration settings maintained in environment variables 
mongoconfig = os.environ['mongoconfig']

def create_mongo_connection():
    try :
        secretsmanager = get_secret()
        SecretString = json.loads(secretsmanager)
        username = SecretString['username']
        password = SecretString['password']
        host = SecretString['host']
        port = SecretString['port']
        mongoclient = MongoClient(host, port, username=username, password=password, 
        authSource='admin',  ssl_ca_certs='rds-combined-ca-bundle.pem',retryWrites='false')
        dbname = mongoconfig['db_name']
        print(dbname)
        return mongoclient[dbname]
    except Exception as e:
        print("Exception : ", e, "\nTraceback : ", format_exc())

Answer 1

The API endpoints for the Secrets Manager live on the Internet. It sounds like the Lambda function is not able to access the Internet.

When an AWS Lambda function is connected to a VPC, it can access resources in the VPC. However, to access the Internet:

• The Lambda function must be in a private subnet, and
• A NAT Gateway must be in a public subnet

If the Lambda function does not require access to resources in the VPC, then simply disconnect the Lambda function from the VPC and it will receive Internet access automatically.

There is another option, which is to Use Secrets Manager with VPC endpoints - AWS Secrets Manager, which creates a tunnel between a VPC and the Secrets Manager.