Say you have connectivity issues between AWS services in a VPC. Rather than change the existing system, you can debug it using a lambda that runs HTTP requests. I’ve included an example below. You can use this lambda to test many URLs and configurations quickly to find a range of problems.<\/p>\n
Note that to communicate with AWS services, you must “sign” AWS HTTP requests. This allows the destination AWS service to know what IAM role the lambda runs as. This example uses a library called aws4 to sign URLs. <\/p>\n
This lambda is small enough to edit through the AWS console, so you can fiddle with the requests once you have it deployed.<\/p>\n
\nexports.handler = (event, context, cb) => {\n const aws4 = require('aws4');\n const https = require('https');\n \n \/\/ Update this to match the AWS url you want to test.\n const signed = aws4.sign(\n {\n host: 'test.us-east-1.es.amazonaws.com', \n path: '\/'\n });\n \n console.log(\"Requesting \" + signed);\n \n https.get(signed, (resp) => {\n let data = '';\n \n resp.on('data', (chunk) => {\n console.log('received ' + chunk);\n data += chunk;\n });\n \n resp.on('end', () => {\n console.log('DATA COMPLETE: ' + JSON.parse(data).explanation);\n cb();\n });\n }).on(\"error\", (err) => {\n console.log(\"ERRORED OUT: \" + err.message);\n \n cb();\n });\n};\n<\/pre>\nOnce you deploy this lambda, set the VPC, security group, subnets, and role and run it through the AWS console – you can name the test event anything you want. <\/p>\n
If the lambda times out, you likely have a network connectivity problem – e.g. a security group doesn’t allow outbound traffic, a firewall prevents traffic to the destination, etc. If you do have network connectivity but it fails quickly, you may have a problem with IAM roles or the HTTPS certificate on the destination. <\/p>\n
Note you can’t do npm install within a lambda because lambda has a readonly filesystem – I tried doing this first to create something you could just paste into the lambda console.<\/p>\n
The follow script will deploy – you can also drop the VPC settings entirely and set them through the console.<\/p>\n
\nzip -r lambda.zip .\n \naws lambda create-function \\\n --function-name test-lambda \\\n --zip-file fileb:\/\/lambda.zip \\\n --runtime 'nodejs10.x' \\\n --handler 'index.handler' \\\n --role 'arn:aws:iam::***:role\/***' \\\n --vpc-config 'SubnetIds=subnet-***,subnet-***,SecurityGroupIds=sg-***'(base)\n<\/pre>\n