16 - Serverless Overviews

Lambda in VPC

awslambdavpcrds-proxysaa-c03

Overview

By default a Lambda function is launched outside your VPC, in an AWS-owned VPC. It has no access to resources inside your VPC, such as an RDS database, an ElastiCache cache or an internal load balancer.

The default deployment works when the function needs:

  • Any public API on the internet.
  • DynamoDB, because it is a public resource on the AWS cloud.

It does not work for a private RDS database.

Launching Lambda in Your VPC

Specify:

  1. The VPC ID.
  2. The subnets to launch in.
  3. A security group attached to the function.

Lambda then creates an Elastic Network Interface (ENI) in your subnets and gets private connectivity to anything in the VPC, for example RDS.

Lambda with RDS Proxy

Problem: Lambda functions that appear and disappear over time and connect directly to RDS can create too many open connections under high load, causing timeouts and issues.

Solution: put an RDS Proxy in front of RDS. The proxy pools and shares connections, so fewer connections reach the database. Lambda connects to the proxy, which connects to the RDS instance.

RDS Proxy benefits

  1. Improves scalability by pooling and sharing database connections.
  2. Improves availability: on failover it reduces failover time by 66% and preserves connections (for RDS and Aurora).
  3. Enforce IAM authentication at the proxy level and store credentials in Secrets Manager.
Exam Pattern

The RDS Proxy is never publicly accessible. The Lambda function must be launched in your VPC to reach it. A Lambda function outside the VPC has no network connectivity to the proxy. The instructor says understanding this solves one or two exam questions.

Lambda in your VPC with RDS Proxy

Lambda functionVPC ID, subnets, SG Your VPC (RDS Proxy is never public) ENIin your subnet RDS Proxypools connections RDSprivate database Fewer open connections reach the database
The function reaches the VPC through an ENI. RDS Proxy pools connections to the private database.

Questions & Answers

Q1: Can a default Lambda function reach a private RDS database?

Answer:

No. By default it runs in an AWS-owned VPC. Launch it in your VPC with VPC ID, subnets and a security group.

Q2: How does Lambda reach private resources?

Answer:

Through an ENI created in your subnets.

Q3: Many Lambda functions overload RDS with connections. Fix?

Answer:

Use RDS Proxy to pool connections. The Lambda functions must be in the VPC.

Q4: Which services does a default (non-VPC) Lambda reach?

Answer:

Public internet APIs and DynamoDB.

Check yourself

Quiz

Flashcards

Click the card (or focus it), then use ← → to move and Space to flip.