I'm trying to access a external MyQSL database (Not AWS RDS), and I need to have a static IP in order to open up the firewall for accepting connections. Is it possible to set a static IP with a Lambda instance? If not what are some other options?
In order to do that, you need to deploy your Lambda function into a VPC and within the VPC, provide NAT Gateway. Then assign an Elastic IP (static IP) to the NAT Gateway. These two links describe it step-by-step:
AWS: How to Create a Static IP Address Using a NAT Gateway (Medium)
How do I give internet access to my Lambda function in a VPC? (AWS Knowledge Center
I have to do this every year or two and always forget how to do it :) Fortunately, I've discovered the AWS now has a wizard that steps you through this process: https://ap-southeast-2.console.aws.amazon.com/vpc/home?region=ap-southeast-2#wizardFullpagePublicAndPrivate:
The wizard didn't pick up my Elastic IP Allocation ID so I had to manually paste it in from the Elastic IP section of the VPC console but after that everything works. https://ap-southeast-2.console.aws.amazon.com/vpc/home?region=ap-southeast-2#Addresses:sort=PublicIp
Then you just set up your lambda function to use that VPC. The only remaining gotcha is to select the Private Subnet that the wizard created rather than the public subnet (of course).
If you are deploying your Lambda functions using SAM rather than the console you can direct your function to use the VPC by including Policy and VpcConfig sections in your SAM template as shown below.
In another year or two when I have to do this again, I'll hopefully find this answer :)
No, this is not possible.
What you should do instead is:
deploy the Lambda function into the private subnet of a VPC
deploy a NAT Gateway (or NAT instance) into a public subnet of the VPC
deploy an Internet Gateway into the VPC
give the NAT an Elastic IP
make the NAT be the default route for the Lambda subnet
whitelist the NAT's Elastic IP at the remote firewall
Is it possible to tell an Amazon EC2 Instance to reconnect the IP?
I know there are scripts to tell a local router (e.g. at home) to reconnect and assign a new IP adress. Is there something similar to the Amazon VMs?
In essence what you are referring to is actually using Elastic IPs.
Basically you reserve an IP address and you can associate and disassociate it from a EC2 instance as you please. You will be able to use that IP as long as you don't release it. (Initially you need to allocate that IP address)
You can also do all the Elastic IP operations programmatically using the AWS API and any of the available SDKs (Java, Ruby, Python, PHP, etc) or using the AWS CLI
For example:
# Allocate Address
aws ec2 allocate-address
# Associate Address
aws ec2 associate-address --instance-id <Your Instance ID> --public-ip <IP Address>
# Disassociate Address
aws ec2 disassociate-address --public-ip <IP Address>
# Release Address
aws ec2 release-address --public-ip <IP Address>
I have some instances with an EC2 VPC (using only ip addresses from RFC 1918) that need to use some services of EC2 via CLI interface (ec2-describe-instances, ec2-run-instances, etc)
I can't get it to work : my understanding is that the service point of the CLI interface is located somewhere in AWS cloud and my requests originating from an RFC1918 address are not routable in the AWS cloud between EC2 service point and my instance.
Is that correct ?
Is my only solution to install a NAT instance within my VPC (I would like to avoid it) ? Or could I get a way to remap this Ec2 service point within my VPC on a RFC1918 address
Any help welcome !
Thanks in advance
didier
You can give the instance an elastic IP address and get outbound access to other publicIPs, like the EC2 API endpoint. Make sure your security group doesn't allow any inbound traffic from the Internet.
Alternatively, if you don't want to use an EIP, you can launch an instance in a VPC with a publicIP address. more here: http://aws.typepad.com/aws/2013/08/additional-ip-address-flexibility-in-the-virtual-private-cloud.html
We're using Amazon EC2, and we want to put an ELB (load balancer) to 2 instances on a private subnet. If we just add the private subnet to the ELB, it will not get any connections, if we attach both subnets to the ELB then it can access the instances, but it often will get time-outs. Has anyone successfully implemented an ELB within the private subnet of their VPC? If so, could you perhaps explain the procedure to me?
Thanks
My teammate and I just have implemented ELB in a VPC with 2 private subnets in different availability zones. The reason you get timeouts is that for each subnet you add to the load balancer, it gets one external IP address. (try 'dig elb-dns-name-here' and you will see several IP addresses). If one of these IP address maps a private subnet, it will timeout. The IP that maps into your public subnet will work. Because DNS may give you any one of the IP addresses, sometimes it works, sometimes it times out.
After some back and forth with amazon, we discovered that the ELB should only be placed in 'public' subnets, that is subnets that have a route out to the Internet Gateway. We wanted to keep our web servers in our private subnets but allow the ELB to talk to them. To solve this, we had to ensure that we had a corresponding public subnet for each availability zone in which we had private subnets. We then added to the ELB, the public subnets for each availability zone.
At first, this didn't seem to work, but after trying everything, we recreated the ELB and everything worked as it should. I think this is a bug, or the ELB was just in an odd state from so many changes.
Here is more or less what we did:
WebServer-1 is running in PrivateSubnet-1 in availability zone us-east-1b with security group called web-server.
WebServer-2 is running in PrivateSubnet-2 in availability zone us-east-1c with security group called web-server.
Created a public subnet in zone us-east-1b, we'll call it PublicSubnet-1. We ensured that we associated the routing table that includes the route to the Internet Gateway (ig-xxxxx) with this new subnet. (If you used the wizard to create a public/private VPC, this route already exists.)
Created a public subnet in zone us-east-1c, we'll call it PublicSubnet-2. We ensured that we associated the routing table that includes the route to the Internet Gateway (ig-xxxxx) with this new subnet. (If you used the wizard to create a public/private VPC, this route already exists.)
Created a new ELB, adding to it PublicSubnet-1 and PublicSubnet-2 (not the PrivateSubnet-X). Also, picked the instances to run in the ELB, in this case WebServer-1 and WebServer-2. Made sure to assign a security group that allows incoming port 80 and 443. Lets call this group elb-group.
In the web-server group, allow traffic from port 80 and 443 from the elb-group.
The key here is understanding, that you are not "Adding subnets/availability zones" to ELB, but rather specifying what subnets to put ELB instances into.
Yes, ELB is a software load balancer and when you create ELB object, a custom loadbalancing EC2 instance is put into the all subnets that you specified. So for the ELB (its instances) to be accessible, they have to be put into the subnets that have default route configured via IGW (most likely you classified these subnets as public).
So as already was answered above, you have to specify "public" networks for ELB, and those networks should be from the AZs where your EC2 instances are running. In this case ELB instances will be able to reach your EC2 instances (as long as security groups are configured correctly)
We've implemented ELB in a private subnet so the statement that all ELB's need to be public isn't completely true. You do need a NAT. Create a private subnet for the private ELB's, turn on VPC DNS and then make sure the private routing table is configured to go through the NAT. The subnet security groups also need to be setup to allow traffic between ELB and App, and App to DB subnets.
Beanstalk health checks won't work as they can't reach the load balancer, but for services that need to be outside of the public reach this is a good compromise.
Suggested reading to get your VPC architecture started: http://blog.controlgroup.com/2013/10/14/guided-creation-of-cloudformation-templates-for-vpc/.
You must add the following settings.
Public subnet zone b = Server NAT
Private subnet zone c = Server Web
Public subnet zone c = ELB
The trick is routing:
The router to NAT is attach with gateway A.
The router to Server Web is attach to NAT.
The router to Public subnet is attach with gateway A.
ELB details:
1.Zone: Public subnet zone c
2.Instance: Server Web
3.Security Groups: enable ports
http://docs.amazonaws.cn/en_us/ElasticLoadBalancing/latest/DeveloperGuide/UserScenariosForVPC.html
Adding a diagram to Nathan's answer. Full medium post here: https://nav7neeet.medium.com/load-balance-traffic-to-private-ec2-instances-cb07058549fd
I have for a long time a VPC (with 1 subnet) on Amazon Web Services (AWS) with several instances each having an Elastic IP address.
For new needs, I have defined a second VPC (with 1 subnet also) on my same account: for some reasons, I can't associate EIP (which is allocated with no problem) to instances launched in VPC #2: the interactive wizard of the console only presents me the instances of the first VPC.
Is it a known limitation or am I doing something wrong?
Two questions:
How many EIP's do you have on your account?
Is the 2nd VPC using a NAT instance to access the Internet?
EIP addresses should only be used on instances in subnets configured to route their traffic directly to the Internet Gateway. EIPs cannot be used on instances in subnets configured to use a NAT instance to access the Internet. (aws.amazon.com)