AWS Lambda function via Function URL invoke only within VPC

Question

I have a lambda function in AWS inside a VPC. I want to attach http handler (function URL).

The problem is, if I enable the function URL then it creates a public endpoint.

Alternatives I don't want to use

enable AWS_IAM security (then the caller will need to use AWS SKD and get token and all)
API gateway trigger (I am already using API gateway as proxy to kubernetes Ingress, I don't want to diverge that)
ALB (I am already using k8s ingress, which creates ALB, so I want the proxy to be created manually by code, not using lambda configuration)

Is there a way we can create AWS Lambda function URL but it should be accessible only within VPC without involving AWS SKD? (like wget URL)

Nope, you'd need to do any authentication in the Lambda function yourself if you want something beyond AWS_IAM security or public access. — Maurice
– Maurice, Commented May 4, 2022 at 11:52

Andres Bores · Accepted Answer · 2023-08-13 23:37:53Z

5

It's a bit late, but nonetheless, the Function URL is always public, and there is no way to make it private as the documentation states (at least at the time of posting this):

You can access your function URL through the public Internet only. While Lambda functions do support AWS PrivateLink, function URLs do not.

You can find more information here https://docs.aws.amazon.com/lambda/latest/dg/lambda-urls.html.

There is another way to invoke the Lambda function privately from a VPC, using VPC Lattice, but this is meant for architectures where you have several services and not an ad-hoc Lambda. However, nothing prevents you from using it for just one Lambda.

Hope it helps.

edited Aug 13, 2023 at 23:37

answered Aug 13, 2023 at 17:08

Andres Bores

8069 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Elliveny · Accepted Answer · 2022-09-07 18:59:57Z

4

I looked into this for a similar use-case, eventually I went with a direct lambda Invoke from the SDK, using the RequestResponse InvocationType to obtain the response payload. This suited my needs, but it might not suit your case.

InvokeResponse response = await lambdaClient.InvokeAsync(new InvokeRequest() {
    FunctionName = "LambdaFunctionName",
    InvocationType = InvocationType.RequestResponse,
    Payload=data
});

answered Sep 7, 2022 at 18:59

Elliveny

2,1132 gold badges23 silver badges32 bronze badges

Comments

Michael Reilly · Accepted Answer · 2022-05-19 18:02:03Z

3

In our org, we ended up going with an internal-only ALB and we enabled MultiValueQueryStringParameters to pass data into the Lambda function and to execute it. This is the only way I could find to provide an internal-only URL that I could further protect with a security group. I couldn't figure out how to make Lambda URLs internal-only.

answered May 19, 2022 at 18:02

Michael Reilly

1011 silver badge2 bronze badges

1 Comment

david grinstein Over a year ago

api gateway can be private and that dns be used inside vpc only

Collectives™ on Stack Overflow

AWS Lambda function via Function URL invoke only within VPC

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related