AWS Lambda + VPC 弹性 IP 超时

Question

我正在尝试为多个 lambda 分配一个静态 ip，以便在 lambda 调用特定服务时我可以将该 ip 列入白名单。

我能够让这个工作，但据我所知，它会随机开始，要么花费几乎恰好 2 分钟到 return 之前的 500 毫秒，要么只是开始一起超时。

下面是我用来设置这个 VPC 的 cloudformation，在这个 cloudformation 中我设置了以下内容：

Public 子网
私有子网
NAT 网关
弹性IP
2 条路线 (public/private)
互联网网关

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "AWS CloudFormation for VPC",
    "Parameters": {
        "env": {
            "Type": "String"
        }
    },
    "Resources": {
        "VPCStaticIP": {
            "Type": "AWS::EC2::VPC",
            "Properties": {
                "CidrBlock": "11.0.0.0/16",
                "Tags": [
                    {
                        "Key": "Name",
                        "Value": {
                            "Fn::Join": [
                                "",
                                ["lambavpc", "-", { "Ref": "env" }]
                            ]
                        }
                    }
                ]
            }
        },
        "SubnetPublic": {
            "Type": "AWS::EC2::Subnet",
            "Properties": {
                "CidrBlock": "11.0.0.0/24",
                "Tags": [
                    {
                        "Key": "Name",
                        "Value": {
                            "Fn::Join": [
                                "",
                                [
                                    "lambavpc",
                                    "-",
                                    { "Ref": "env" },
                                    "-",
                                    "public-subnet"
                                ]
                            ]
                        }
                    }
                ],
                "VpcId": {
                    "Ref": "VPCStaticIP"
                }
            }
        },
        "SubnetPrivate": {
            "Type": "AWS::EC2::Subnet",
            "Properties": {
                "CidrBlock": "11.0.1.0/24",
                "Tags": [
                    {
                        "Key": "Name",
                        "Value": {
                            "Fn::Join": [
                                "",
                                [
                                    "lambavpc",
                                    "-",
                                    { "Ref": "env" },
                                    "-",
                                    "private-subnet"
                                ]
                            ]
                        }
                    }
                ],
                "VpcId": {
                    "Ref": "VPCStaticIP"
                }
            }
        },
        "InternetGateway": {
            "Type": "AWS::EC2::InternetGateway",
            "Properties": {
                "Tags": [
                    {
                        "Key": "Name",
                        "Value": {
                            "Fn::Join": [
                                "",
                                ["lambavpc", "-", { "Ref": "env" }, "-", "igw"]
                            ]
                        }
                    }
                ]
            }
        },
        "VPCGatewayAttachment": {
            "Type": "AWS::EC2::VPCGatewayAttachment",
            "Properties": {
                "InternetGatewayId": {
                    "Ref": "InternetGateway"
                },
                "VpcId": {
                    "Ref": "VPCStaticIP"
                }
            }
        },
        "RouteTablePublic": {
            "Type": "AWS::EC2::RouteTable",
            "Properties": {
                "VpcId": {
                    "Ref": "VPCStaticIP"
                },
                "Tags": [
                    {
                        "Key": "Name",
                        "Value": {
                            "Fn::Join": [
                                "",
                                [
                                    "lambavpc",
                                    "-",
                                    { "Ref": "env" },
                                    "-",
                                    "public-route"
                                ]
                            ]
                        }
                    }
                ]
            }
        },
        "RoutePublic": {
            "Type": "AWS::EC2::Route",
            "Properties": {
                "DestinationCidrBlock": "0.0.0.0/0",
                "GatewayId": {
                    "Ref": "InternetGateway"
                },
                "RouteTableId": {
                    "Ref": "RouteTablePublic"
                }
            }
        },
        "SubnetRouteTableAssociationPublic": {
            "Type": "AWS::EC2::SubnetRouteTableAssociation",
            "Properties": {
                "RouteTableId": {
                    "Ref": "RouteTablePublic"
                },
                "SubnetId": {
                    "Ref": "SubnetPublic"
                }
            }
        },
        "EIP": {
            "Type": "AWS::EC2::EIP",
            "Properties": {
                "Domain": "vpc",
                "Tags": [
                    {
                        "Key": "Name",
                        "Value": {
                            "Fn::Join": [
                                "",
                                ["lambavpc", "-", { "Ref": "env" }, "-", "eip"]
                            ]
                        }
                    }
                ]
            }
        },
        "NatGateway": {
            "Type": "AWS::EC2::NatGateway",
            "Properties": {
                "AllocationId": {
                    "Fn::GetAtt": ["EIP", "AllocationId"]
                },
                "SubnetId": {
                    "Ref": "SubnetPublic"
                }
            }
        },
        "RouteTablePrivate": {
            "Type": "AWS::EC2::RouteTable",
            "Properties": {
                "VpcId": {
                    "Ref": "VPCStaticIP"
                },
                "Tags": [
                    {
                        "Key": "Name",
                        "Value": {
                            "Fn::Join": [
                                "",
                                [
                                    "lambavpc",
                                    "-",
                                    { "Ref": "env" },
                                    "-",
                                    "private-route"
                                ]
                            ]
                        }
                    }
                ]
            }
        },
        "RoutePrivate": {
            "Type": "AWS::EC2::Route",
            "Properties": {
                "DestinationCidrBlock": "0.0.0.0/0",
                "NatGatewayId": {
                    "Ref": "NatGateway"
                },
                "RouteTableId": {
                    "Ref": "RouteTablePrivate"
                }
            }
        },
        "SubnetRouteTableMainAssociationPrivate": {
            "Type": "AWS::EC2::SubnetRouteTableAssociation",
            "Properties": {
                "RouteTableId": {
                    "Ref": "RouteTablePrivate"
                },
                "SubnetId": {
                    "Ref": "SubnetPrivate"
                }
            }
        }
    },
    "Outputs": {}
}

我做了很多研究并找到了这些参考资料：

https://gist.github.com/reggi/dc5f2620b7b4f515e68e46255ac042a7

但我似乎无法推断出我正在做的事情与他们的建议之间的差异是什么。

如有任何建议，将不胜感激！

Answer 1

EIP 超时可能是因为您 在您的 AWS::EC2::VPCGatewayAttachment 上没有 DependsOn attribute。在您的情况下，需要：

If you define an Elastic IP address and associate it with a VPC that is defined in the same template, you must declare a dependency on the VPC-gateway attachment by using the DependsOn Attribute on this resource.

因此，您可以尝试以下添加依赖项：

"EIP": {
    "Type": "AWS::EC2::EIP",
    "DependsOn" : "VPCGatewayAttachment",    
    "Properties": {
        "Domain": "vpc",
        "Tags": [
            {
                "Key": "Name",
                "Value": {
                    "Fn::Join": [
                        "",
                        ["lambavpc", "-", { "Ref": "env" }, "-", "eip"]
                    ]
                }
            }
        ]
    }
}

此外，如果可能的话，我会考虑使用 private IP range of 10.0.0.0/16 for your VPC and subnets instead of 11.0.0.0/16. The range is recommended 供 AWS 使用：

When you create a VPC, we recommend that you specify a CIDR block (of /16 or smaller) from the private IPv4 address ranges as specified in RFC 1918:

10.0.0.0 - 10.255.255.255（10/8 前缀）
172.16.0.0 - 172.31.255.255（172.16/12 前缀）
192.168.0.0 - 192.168.255.255（192.168/16 前缀）

Answer 2

您没有说明您是如何创建 Lambda 函数的，它是在 CloudFormation 之外创建的吗？听起来您已将 Lambda 函数配置为使用两个 VPC 子网，并且当它在 public 子网内运行时会超时。您需要将 Lambda 函数配置为仅使用带有 NAT 网关路由的私有子网。

AWS Lambda + VPC 弹性 IP 超时

AWS Lambda + VPC Elastic IP Timeout

amazon-web-services

amazon-vpc

aws-lambda