I have an application which uses lambda and fargate (task) containers for compute, EventBridge for communication, S3 and DynamoDB for storage and exposes data out via an API Gateway.

From my reading I can see that I can use PrivateLink or similar to expose each of these services into a VPC. However, all the documentation seems to suggest this is useful for accessing EC2 and RDS instances which live in the VPC. Is there any advantage to routing the communications for my services (Lambda,S3,DynamoDB etc) through a VPC when none of them really live in the VPC or is it just adding an unnecessary level of complexity to the application?


1 Answer 1


Bearing in mind that all AWS Lambda to AWS Service calls are HTTPS anyways, it depends on how scared you are of the internet.

By default, all AWS APIs (like the ones the SDKs use) exist on the internet. By using VPC endpoints you can force these calls over AWS backbone network and steer clear of the internet all together. A VPC endpoint only allows traffic from a particular VPC to a particular service, e.g. a Lambda attached to a VPC uses a VPC endpoint to call DynamoDB without traversing the internet.

You can create IAM Roles that allow access to an AWS service, but are only valid when the traffic is coming from a particular VPC. This DOES NOT turn off those AWS APIs on the internet. You can't stop a user coming in through the internet with an IAM role that gives access to the AWS service being called, if that role does not specify a VPC.

S3 Bucket Policies can limit access to individual VPCs, so someone coming in through the internet may not be able to access the contents of an S3 bucket (regardless of IAM role), they could however still delete it (if they had access to an IAM role allowing such an action).

Lastly, by removing all internet access from a Lambda, you can make it more difficult to run injection attacks against it, as they often involve forcing a Lambda to download (and then run) arbitrary code from the internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.