01
Locate the wait inside the invocation
Separate initialization, DNS lookup, connection establishment, TLS negotiation, and the remote response. Use application logs with timestamps and a request identifier. Give the outbound client its own bounded timeout so one failed network request does not consume the entire invocation without useful evidence.
Compare a private destination and a public destination from the same function configuration. Private database success establishes only that private path. It does not demonstrate public internet routing. Avoid recording authorization headers or full URLs that contain credentials in diagnostic logs.
02
A public subnet does not automatically give Lambda a public address
AWS documents that a VPC-connected function needs an appropriate network path for external access. Selecting a subnet that has an internet-gateway route is not equivalent to assigning the function a public IPv4 address. For a conventional IPv4 setup, private subnets route outbound internet traffic through a public NAT gateway.
Draw the specific path for each selected subnet: function interface → subnet route table → NAT gateway → internet gateway. Check every configured subnet, because a correct route for one subnet does not repair a different subnet selected for the same function.
03
Inspect before provisioning anything
Start with the function’s VPC configuration and the associated routing information. These read-only commands use explicit placeholder identifiers. The route table that applies may be an explicitly associated table or the VPC’s main table, so do not assume the first table returned is the effective one.
For public NAT, check that its subnet routes toward an internet gateway, the gateway has the necessary public addressing, and the route from the function subnet points to the intended NAT target. Also check security-group egress, network ACL return traffic, and DNS configuration. Do not broaden all rules to the internet to test an unproven theory.
aws lambda get-function-configuration --function-name example-function --query '{Vpc:VpcConfig,Timeout:Timeout}'
aws ec2 describe-subnets --subnet-ids subnet-example
aws ec2 describe-route-tables --filters Name=vpc-id,Values=vpc-example
aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=vpc-example04
Choose the route that matches the destination
If the function genuinely needs a public IPv4 endpoint, configure the approved NAT and routing path through infrastructure review. NAT gateways have cost and availability implications; adding one should be a deliberate architecture change, not an automatic response to any timeout.
If the destination is an AWS service, investigate whether an appropriate VPC endpoint meets the requirement without general internet access. Endpoint type, supported service, region, DNS, and policy still matter. Dual-stack IPv6 designs follow a different path; do not apply an IPv4 NAT recipe to them by habit.
05
Retest with the same network placement
Run a controlled invocation and inspect the outbound request’s timing and outcome. Test the function with the actual subnet set and security groups intended for production. Confirm both the private dependency and the public destination still work, rather than trading one working path for another.
Compare error classes after the routing change. A quick HTTP 401 or 403 means the request reached a responding service but authorization still needs work. A successful TCP connection is progress, not proof that the business operation succeeded. Retain the route change and the request evidence together.
06
Keep timeout changes separate from the diagnosis
A longer function timeout can hide a missing route by delaying failure. First establish whether the path exists, then choose client and function timeout budgets appropriate to the operation. If the route was already correct, investigate resolver behavior, policy, TLS, connection reuse, and destination availability.
The useful conclusion is narrow: a particular request path failed under a particular network configuration and passed after a specific correction. “Lambda is running” and “the VPC exists” are resource observations, not evidence that this outbound call can complete.
Know the limits
The routing example describes conventional IPv4 egress. It does not provision cloud resources or promise that NAT is the cause of every timeout. Commands require read permissions in the correct account and region.
Sources & further reading
A technical publication by CoreTrailKit.
Browse all articles