AWS Lambda using firebase-admin initializeApp timeout

Question

I am using the Lambda to Firebase post. I am returning this one . But the lambda function still does not work, because it cannot connect to google server.

Handler.js

/ [START imports] const firebase = require('firebase-admin'); const serviceAccount = require("../serviceAccount.json"); module.exports.message = (event, context, callback) => { context.callbackWaitsForEmptyEventLoop = false; const registrationToken = "xxxxxxx"; const payload = { data: { score: "850", time: "2:45" } }; // [START initialize] if(firebase.apps.length == 0) { // <---Important!!! In lambda, it will cause double initialization. firebase.initializeApp({ credential: firebase.credential.cert(serviceAccount), databaseURL: 'https://messaging-xxxxx.firebaseio.com' }); } // Send a message to the device corresponding to the provided // registration token. firebase.messaging().sendToDevice(registrationToken, payload) .then(function(response) { // See the MessagingDevicesResponse reference documentation for // the contents of response. console.log("Successfully sent message:", response); callback(null, { statusCode: 200, body: JSON.stringify("Successful!"), }); }) .catch(function(error) { console.log("Error sending message:", error); callback(null, { statusCode: 500, body: JSON.stringify({ "status": "error", "message": error }) }) }); }; 

Cloudwatch

[Error: the access rights granted by initializeApp () through the "credential" property could not get a valid Google OAuth2 access token with the following error: "connect ETIMEDOUT 172.217.26.45:443".]

But I use the same serviceAccount.json to run on my ec2 and find a job. Does anyone come across this?

Answer 1

After hours of fighting, I finally found the reason. Since my Lambda, which uses VPC to connect RDS and VPC network interface, has only private IP.

AWS Document :

When you add a VPC configuration to a Lambda function, it can only access resources in that VPC. If Lambda features need to access VPC resources and the public Internet, the VPC must have an instance of Network Address Translation (NAT) inside the VPC.

Therefore, I need to create NAT inside VPC. I follow this blog and the problem is resolved.