57

After giving all the rights to invoke function. My Lambda function is not able to invoke another function . Every time I am getting timeout having 30 seconds timeout issue. It looks like lambda is not able to get another lambda function

My lambdas are in same region, same policy, same security group .. Also VPC are same in both lambdas. The only thing is different now is lambda functions

Here are the role rights

1) created AWSLambdaExecute and AWSLambdaBasicExecutionRole

2) Created one lambda function which is to be called Lambda_TEST

exports.handler = function(event, context) {
  console.log('Lambda TEST Received event:', JSON.stringify(event, null, 2));
  context.succeed(event);
};

3) Here is a another function from where it is called .

var AWS = require('aws-sdk');
AWS.config.region = 'us-east-1';
var lambda = new AWS.Lambda();

exports.handler = function(event, context) {
 var params = {
   FunctionName: 'Lambda_TEST', // the lambda function we are going to invoke
   InvocationType: 'RequestResponse',
   LogType: 'Tail',
   Payload: '{ "name" : "Arpit" }'
 };

  lambda.invoke(params, function(err, data) {
   if (err) {
    context.fail(err);
   } else {
   context.succeed('Lambda_TEST said '+ data.Payload);
  }
 })
};

Reference taken from : This link

9
  • Is your Lambda function running inside a VPC?
    – Mark B
    Aug 25, 2016 at 12:48
  • Yes, and both are sharing same VPC , lambda execution role and security group . . Thanks for reply Aug 25, 2016 at 12:50
  • 2
    You won't be able to access the AWS API, or anything else that exists outside your VPC, from a Lambda function that exists in your VPC unless you add a NAT Gateway to the VPC.
    – Mark B
    Aug 25, 2016 at 12:56
  • 2
    None of those details matter in this instance. You are trying to call the AWS API, which happens to be a resource that exists outside your VPC.
    – Mark B
    Aug 26, 2016 at 12:28
  • 1
    Mark is correct. See docs.aws.amazon.com/lambda/latest/dg/… . Aug 26, 2016 at 17:16

3 Answers 3

86
+50

Note

I will denote by executor the lambda that executes the second lambda.


Why Timeout?

Since the executor is "locked" behind a VPC - all internet communications are blocked.

That results in any http(s) calls to be timed out as they request packet never gets to the destination.

That is why all actions done by aws-sdk result in a timeout.


Simple Solution

If the executor does not have to be in a VPC - just put it out of it, a lambda can work as well without a VPC.

Locating the lambda in a VPC is required when the lambda calls resources inside the VPC.

Real Solution

From the above said, it follows that any resource located inside a VPC cannot access the internet - that is not correct - just few configurations need to be made.

  1. Create a VPC.
  2. Create 2 Subnets, let one be denoted as private and the second public (these terms are explained ahead, keep reading).
  3. Create an Internet Gateway - this is a virtual router that connects a VPC to the internet.
  4. Create a NAT Gateway - pick the public subnet and create a new elastic IP for it (this IP is local to your VPC) - this component will pipe communications to the internet-gateway.
  5. Create 2 Routing Tables - one named public and the second private.

    1. In the public routing table, go to Routes and add a new route:

    Destination: 0.0.0.0/0

    Target: the ID of the internet-gateway

    1. In the private routing table, go to Routes and add a new route:

    Destination: 0.0.0.0/0

    Target: the ID of the nat-gateway

    • A private subnet is a subnet that in its routing table - there is no route to an internet-gateway.

    • A public subnet is a subnet that in its routing table - there exists a route to an internet-gateway


What we had here?

We created something like this:

VPC with NAT and IGW

This, what allows resources in private subnets to call out the internet. You can find more documentation here.

11
12

I've experienced this same problem where Lambdas that are "pinned" to a VPC are not able to invoke other Lambdas. I've been dealing with this issue, without using NAT, by refactoring the structure of my solution.

Let's say I have several lambdas, A, B, C, D,... and I would like these Lambdas to each have query access to an RDS database. In order to have this DB access, I need to put the lambdas in same VPC as database. But I'd also like various lambdas among A, B, C, D,... to invoke one another. So I run into the problem that Arpit describes.

I've been dealing with this issue by splitting each Lambda into two Lambdas: one that focuses on the process flow (i.e. invoking other lambdas and being invoked by another lambda); and the other focusing on doing "real" work, like querying the database. So I now have functions A_flow, B_flow, C_flow, D_flow, ...; and functions A_worker, B_worker, C_worker, D_worker, ... The various flow lambdas are not "pinned" to a specific VPC, and can thus invoke other lambdas. The various worker Lambdas are in the same VPC as database, and can query the DB.

Each flow lambda "delegates" the work of interacting with DB to the corresponding worker lambda. It does this delegation by performing a synchronous invocation of the worker lambda. The worker lambdas do not invoke any other lambdas. (In terms of process flow graph, the worker lambdas are terminal nodes.) In my own system, the invocations of flow Lambdas by other flow lambdas have generally been asynchronous; but I suppose they could be synchronous if desired.

Even though I devised this approach as a workaround, it has a nice feature of cleanly separating the high-level function design into (a) process flow and (b) performing more detailed work, including interaction with DB resources.

6
  • Can't believe this worked, but this is faster and easier way. I still wonder why a Lambda outside VPC can invoke a Lambda inside a VPC while the vice-verse cannot. Jan 24, 2018 at 13:01
  • I used the same approach...but since a couple of days it seems lambdas outside the VPC are not able to invoke lambdas inside....am I missing something? Each lambda has policy to invoke the destination lambda....
    – Bagbyte
    Feb 27, 2018 at 16:53
  • I follow the steps but it didn't work out. I want to use Gmail SMTP details in Lambda function, as well as connect to RDS instance that is inside a VPC. If I remove the VPC then it cannot connect to RDS until I make that available public, and mail worked. But if put Lambda in the same VPC then RDS connection worked but Mail function giving "Connection Timeout". I have created NAT Gateway with Elastic IP and associate with same subnet of Lambda but still the same issue. Oct 25, 2018 at 12:33
  • 1
    It all seems crazy but this works. A lambda outside a VPC can invoke a lambda within the VPC but not the other way around. Setting up a NAT GW would be a simple solution that would allow many things but it costs quite a bit (for me anyway) when running personal experiments/learning all this.
    – kg_sYy
    Aug 11, 2019 at 13:15
  • 1
    This approach is correct when the invoker lambda can remain outside a VPC. It works because the invoker lambda has access to AWS API which is a public endpoint. Via the API you can instantiate any resource and doesn't matter where it is.
    – elier
    Sep 11, 2020 at 2:50
2

As of Oct 2020, AWS PrivateLink is an easier solution than configuring an internet-gateway/NAT-gateway. See release notes here, and links to PrivateLink documentation therein: https://aws.amazon.com/blogs/aws/new-use-aws-privatelink-to-access-aws-lambda-over-private-aws-network/

Note that, if both lambdas are in different VPCs, and the executing lambda needs to handle a response from the target lambda, then both lambdas will need an endpoint.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.