AWS Security Group Input Rule. enable lambda function

Question

I start the service on my EC2 instance, and I want to configure an incoming rule that allows my lambda function to access it. The security group allows me to restrict access to a specific IP address, but I don't think lambda functions have a specific IP address. Is there a way to do what I want?

Answer 1

If you allow VPC access for your Lambda function, according to this blog post , you will create a security group for your lambda functions for use in your VPC. All you need to do at this point is to log in to the security group that the EC2 instance is using and grant access to the security group that the Lambda function uses. This is my recommended method.

If you are not using VPC access, your EC2 instance must be publicly available, and you basically go over the Internet to access the EC2 instance from the Lambda function. If this is the case, then there is no good way to limit this to a security group. You could (with difficulty) open it only until it appears in AWS , but it still leaves it open to all other AWS users. If you have to go over the Internet to access your EC2 instance from Lambda, it would be better to send some kind of security token with every Lambda send request and ignore any requests on the EC2 server that do not contain this security token.

Answer 2

A lambda that does not have a VPC connection will be on the Internet and it will be assigned an arbitrary public IP address (obviously, from Amazon's registered IP addresses), which will not be a fixed address. Thus, it is almost impossible to whitelist that IP in your EC2 SG, since the next time Lambda spins IP, it can change and will not be predictable.

However, there is a way to partially restrict network access only to resources located in the VPC, including lambda channels (since the components will be assigned with internal IP addresses). Suppose you want the EC2 server to be accessible only from the vpc internal network, so you put it on the internal subnet without a public IP address assigned to it. Now you can configure SG on EC2 so that it accepts IP only from the CIDR range of your VPC's internal subnet. By associating Lambda with this VPC and placing it on a private subnet, Lambda will receive an arbitrary IP address from the internal CIDR range of your VPC, which obviously falls into the SG range already configured for your EC2 (if you have a lot of Lambda in parallel, just make sure that you have a sufficient number of IP addresses within your defined CIDR range).

If you want your components to communicate internally, you can also connect to the Internet, and you can add the NAT Gateway Routable to the IGW, and then add a routing rule to the internal subnets to point to the NAT gateway. Therefore, all of your component on the internal subnet will be assigned by routing tables pointing to NAT and then to the Internet.

Answer 3

Your Lambda will be assigned a temporary IP address when it will work. If you configure the IAM role attached to it so that it can enable / disable access to the security group, you can make it "let itself in" in your sec group. This article provides an example of adding an IP or CIDR block to your inbox. I would remove it right away when the function is done.

Answer 4

Please use the following link to configure Lambda with VPC and security groups. And make sure that you use ONLY the EC2 private IP address when starting from Lambda (program).

1.) https://aws.amazon.com/blogs/aws/new-access-resources-in-a-vpc-from-your-lambda-functions/ 2.) https: //docs.aws.amazon. com / lambda / latest / dg /vpc.html