Why can I call an on-VPC aws lambda from an off-VPC aws lambda but not vice versa?

Question

So if I have two lambdas, one inside a private VPC, and one not on a VPC, calling the private lambda from inside the public lambda works but I cant call the public from the private lambda.

There's no NAT setup.

Why is this? It seems that I should not be able to call the private from the public theoretically.

Answer 1

In order to trigger a Lambda function, all that's required is for the caller to have outbound access to the Invoke AWS API. It is not necessary for the invoked Lambda function to have any open inbound ports, or any public Internet access.

So a public (non-VPC, has Internet access) Lambda function can call the Invoke API to trigger the private Lambda function, but the private VPC (no Internet access) Lambda function cannot access the Invoke API to trigger any Lambda function.

Answer 2

Inside VPC you need an AWS VPC interface endpoint (https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint). It allows access to AWS Lambda service without going through the Internet.

Answer 3

To solve this issue you may configure the lambda inside the VPC to have internet access. This article explains how to set up this configuration.