AWS Lambda in VPC with RDS and Internet Connection

Question

I set up an Aurora Database (provisioned) in a newly created VPC and no public accessibility. As I want to run a Lambda function in the VPC that is able to both, access the RDS instances as well as the Internet, I changed the routing tables of the RDS instances to allow traffic from a NAT gateway which I placed in a public subnet in the same VPC.

For the Lambda function itself, I created a separate private subnet, also just allowing traffic from the NAT gateway in the routing table. I assigned this subnet and VPC to the Lambda function in the Lambda settings. The internet connection works fine with this configuration but I can not access the database. That's why I followed this post (https://serverfault.com/questions/941886/connect-an-aws-lambda-function-triggered-by-api-gateway-to-aurora-serverless-mys) and added the IP CIDR of the Lambda subnet to the Security Group of the RDS instances (called rds-launch-wizard).

Still, the Lambda function is able to interact with the public internet but can not connect to the RDS instances (timeout). I'm running out of ideas, what is wrong here?

Answer 1

The configuration should be:

• A public subnet with a NAT Gateway (and, by definition, an Internet Gateway)

• A Private subnet with the Amazon RDS instance

• The same, or a different, Private Subnet associated with the Lambda function

• The Private Subnet(s) configured with a Route Table with a destination of 0.0.0.0/0 to the NAT Gateway

Then consider the Security Groups:

• A security group for the Lambda function (Lambda-SG) that permits all outbound access

• A security group for the RDS instance (RDS-SG) that should permit inbound access from Lambda-SG on the appropriate database port

That is, RDS-SG is allowing incoming traffic from Lambda-SG (by name). There is no need to use CIDRs in the security group.

The Lambda function will connect to a private subnet via an Elastic Network Interface (ENI) and will be able to communicate both with the RDS instance (directly) and with the Internet (via the NAT Gateway).

Please note that you are not directing "traffic from the NAT Gateway". Rather, you are directing Internet-bound traffic to the NAT Gateway. Nor is there such a thing as "routing tables of the RDS instances" because the Route Tables are associated with subnets, not RDS.