AWS Lambda: Unable to access SQS Queue from a Lambda function with VPC access

At the end of 2018, AWS announced support for SQS endpoints which provide

connectivity to Amazon SQS without requiring an internet gateway, network address translation (NAT) instance, or VPN connection.

There is a tutorial for Sending a Message to an Amazon SQS Queue from Amazon Virtual Private Cloud

See also the SQS VPC Endpoints Documentation for more information.

Its important to note that if you want to access SQS within the Lambda VPC there are a couple other things you need to do:

  • Make sure to specify the SQS region in your code. For example, I had to set my endpoint_url to "https://sqs.us-west-2.amazonaws.com"
  • Make sure that you have attached a "wide open" security group to the SQS VPC Interface, otherwise SQS will not work.
  • Make sure that your subnets in your Lambda VPC match what you have set up for your SQS VPC Interface.

Some services (e.g. S3) are offering VPC endpoints to solve this particular problem but SQS is not one of them. I think the only real solution to this problem is to run a NAT inside your VPC so the network traffic from the Lambda function can be routed to the outside world.

Tags:

Aws Lambda