25

I am looking to assign a static IP to my Lambda which is being invoked via the API gateway. This is required because, the downstream system that i invoke from this lambda accepts web requests only from a Whitelisted IP.

I am successful in achieving this via the VPC that i associate with my lambda. But VPC introduces a bad cold-start time which sometime ranges 12-16seconds. So i am looking for a way to prevent this cold start from the VPC, but at the same time assign a static IP to the lambda.

John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
infernal_lad
  • 425
  • 1
  • 7
  • 13
  • Cold start times in VPC should now be significantly reduced per https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/ – jarmod Sep 10 '19 at 15:49
  • 5
    It's really unfortunate that a VPC is required because it requires the addition of a NAT for outbound internet access and NATs are absurdly expensive for very low volume applications, such as testing environments. – pythonjsgeo Sep 21 '20 at 07:42

4 Answers4

31

You will need to:

  • Create a VPC with an Internet Gateway, a public subnet and a private subnet
  • Attach the AWS Lambda function to the private subnet
  • Launch a NAT Gateway in the public subnet and update the Route Table of the private subnet to use the NAT Gateway

The NAT Gateway will use an Elastic IP address (which is a static IP address). All traffic from the Lambda function to the Internet will come from this IP address, which can be used in the whitelist.

You might think that this is a bit of overkill for simply attaching a static IP address, but multiple Lambda function can run in parallel and they could run in multiple Availability Zones. Sending all traffic through the NAT Gateway is the only way to ensure they all have the same IP address. (Or, to be more specific, one IP address per AZ in which the NAT Gateway is launched.)

John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
  • How about the scenario where lambda calls on prem servers through DX? Does this step by step apply to this alternative scenario as well? Or should the whitelist be the subnet CIDR range? – Judy007 Aug 06 '20 at 03:01
  • @jbooker The above would not work for a Direct Connect connection, since the traffic won't go through the NAT Gateway (assuming that it is configured so that the private subnets connect to DX). I like your idea of whitelisting the CIDRs of the subnet(s) that Lambda uses. – John Rotenstein Aug 06 '20 at 03:03
  • Thank you John! You are amazing! I keep seeing your answers all over the posts I’m after recently, you are on top of it!! I swear! Quality answers and comments from you, always – Judy007 Aug 06 '20 at 03:44
  • Once we have this setup, will it be possible to invoke our Lambda in the private subnet from another Lambda outside of this VPC? If so, we can use this single Lambda as a way to route our requests such that they get a static IP w/o putting all our logic in that Lambda/VPC. – pir Jan 11 '21 at 23:16
  • 1
    @pir Yes, that would work. You can invoke the Lambda function from anywhere on the Internet. – John Rotenstein Jan 11 '21 at 23:19
  • Perfect, thanks so much for the quick response! – pir Jan 11 '21 at 23:19
11

You can't assign a public/static IP to any Lambda function.

Your only good option is to deploy into a VPC with an Internet Gateway and configure routing from the Lambda's subnet through a NAT which has an Elastic IP. Then your target host can whitelist the Elastic IP.

Also see:

John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
jarmod
  • 71,565
  • 16
  • 115
  • 122
7

I agree with the answer by John for having static IP whitelisting part. However, it won't resolve your cold start problem because lambda,if ideal, actually takes a small time to start. So I would recommend you also create a Cloudwatch event to hit lambda periodically to resolve this or write a simple code(either in lambda or somewhere else) which sends an empty request periodically so that cold start problem is resolved. You can view the improvement in X-Ray. This is an overhead but one time process.

deosha
  • 972
  • 5
  • 20
  • thanks. I was pretty sure that VPC would help me assign a static IP. But i would not ease the cold start time a bit. So, I did not wanted to go the route of VPC as i said in my question. A periodic request to the lambda is what i am going to try. – infernal_lad Jun 20 '19 at 14:23
  • You may want to accept the answer if it worky for you :-) – deosha Jun 20 '19 at 15:44
  • AWS has a done a lot of work to [improve cold start times](https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/) including [provisioned concurrency](https://docs.aws.amazon.com/lambda/latest/operatorguide/provisioned-scaling.html) since this answer was written. – jarmod Mar 31 '22 at 14:00
0

To eliminate cold starts, you can use a service like https://lambdawarmer.com to keep a desired number of lambda instances always warm.

It basically uses a bunch of servers to periodically and exactly concurrently hit an endpoint on your lambda to keep a certain number of lambdas always warm.

Mike Panoff
  • 41
  • 4