How do I allow AWS lambda resources in a private subnet VPC to communicate with the internet without using a NAT?

Question

In my case i have an AWS aurora serverless database. The database is located in a private subnet to isolate the instance from public. If your lambda function needs access to the database you also have to attach the lambda to the private subnet and create security groups to grant access within your private subnet over the protocol and port used by the database.

But what is if your lambda needs external connectivity. For example to communicate to third party apps like paypal.

How do I allow AWS lambda resources in a private subnet VPC to communicate with the internet without using a NAT ?

Because of my fully serverless stack i like to avoid permanent fixed costs by using a NAT.

Answer 1

You cannot do this. As per the AWS docs, if your Lambda is running inside of a VPC and it needs internet access, you will need a NAT or an Instance.

You can read about this here: https://aws.amazon.com/premiumsupport/knowledge-center/internet-access-lambda-function/