<p>No, it's not possible to place an AWS Lambda in a public subnet and thus avoid paying for NAT. Lambda functions cannot have public IPs so they cannot route to the internet without a NAT (gateway or instance).</p>

<p>Put them in a private subnet, ensure the private subnet's default route is a NAT in a public subnet, that the NAT has a public IP, and that the VPC has an IGW.</p>

<p>For more, see <a href="https://stackoverflow.com/questions/52992085/why-cant-an-aws-lambda-function-inside-a-public-subnet-in-a-vpc-connect-to-the">this Stack Overflow question</a>.</p>

CC BY-SA 4.0
2019-12-12T18:48:36.100Z
2019-12-12T18:48:36.100Z
jarmod
<p>Provided the <em>Public Subnet</em> where you're launching your Lambda is configured with <strong>Auto-assign public IPv4 address: Yes</strong> it should work in public a subnet without NAT.</p>

<p>Whether or not it's a good idea is another question. In general you shouldn't launch any backend services in the public subnets, the public subnets are for things like API Gateways, NAT Gateways, Load Balancers, etc. Not for launching the actual backend systems. That's the best security practice. </p>

<p>However that aside I'm pretty confident that with <em>auto-assign IPv4 address</em> enabled Lambdas will work even in the public subnet.</p>

<p>Unless you want the Lambda to connect to any VPC-internal resources (e.g. to your RDS) you may just as well launch it without VPC config (leave those VPC and Subnet settings empty). That will give it access to the internet without having to worry about NAT or public IPs.</p>

<p>Hope that helps</p>

CC BY-SA 4.0
2018-10-28T14:33:35.723Z
I tried configuring the lambda to be in a public subnet with `Auto-assign public IPv4 address: Yes` but I don't think it was able to connect to the internet. The public subnet also has an IGW at 0.0.0.0/0 in the routing table.
Leo Lei
CC BY-SA 4.0
2019-04-08T21:52:28.820Z
@LeoLei here's some checklist items... 1 check the VPC network ACL (ensure inbound & outbound is enabled for TCP over port 443 (https)) ,, 2 check the Lambda security group, ensure outbound TCP over port 443 is enabled ,, 3 check the VPC route table, ensure a default route to the IGW is available
sudo soul
CC BY-SA 4.0
2019-12-12T18:42:21.203Z
No, Lambda functions do not get a public IP, regardless of the auto-assign IPv4 address setting. They cannot have public IPs. To reach the internet, they must route through a NAT (which routes to an IGW).
jarmod
CC BY-SA 4.0
2018-09-24T06:08:14.910Z
2018-09-24T06:08:14.910Z
MLu
<p>Is it possible to place an aws lambda in a public subnet and thus avoid paying for <code>NAT</code>?</p>

<p>The <a href="https://docs.aws.amazon.com/lambda/latest/dg/vpc.html" rel="noreferrer">docs</a> state the following</p>

<blockquote>
  <p>If your Lambda function needs Internet access, do not attach it to a public subnet or to a private subnet without Internet access. Instead, attach it only to private subnets with Internet access through a NAT instance or an Amazon VPC NAT gateway.</p>
</blockquote>

<p>But do not explain why we can not attach the lambda to a public subnet.</p>

CC BY-SA 4.0
2018-09-11T13:48:00.970Z
Because aws doesn't want to directly expose their instance running your code...(That's my guess)
Tensibai
CC BY-SA 4.0
2018-09-11T22:45:55.243Z
A cheaper alternative to the $35/mo NAT Gateway is to create an NAT instance: https://aws.amazon.com/premiumsupport/knowledge-center/vpc-nat-instance/
Ulad Kasach
<amazon-web-services><aws-lambda><aws-vpc>
Placing an AWS Lambda in a public subnet
Ulad Kasach
# Placing an AWS Lambda in a public subnet

(Asked by: username_0 on 2018-09-11)

Is it possible to place an aws lambda in a public subnet and thus avoid paying for `NAT`?

The [docs](https://docs.aws.amazon.com/lambda/latest/dg/vpc.html) state the following

> If your Lambda function needs Internet access, do not attach it to a public subnet or to a private subnet without Internet access. Instead, attach it only to private subnets with Internet access through a NAT instance or an Amazon VPC NAT gateway.

But do not explain why we can not attach the lambda to a public subnet.

**Tags:** amazon-web-services, aws-lambda, aws-vpc

> **Comments:**
> **username_1**: Because aws doesn't want to directly expose their instance running your code...(That's my guess)  
> **username_0**: A cheaper alternative to the $35/mo NAT Gateway is to create an NAT instance: https://aws.amazon.com/premiumsupport/knowledge-center/vpc-nat-instance/  

---

## 2 answers

### Answer by username_2 on 2019-12-12. Score: 5

No, it's not possible to place an AWS Lambda in a public subnet and thus avoid paying for NAT. Lambda functions cannot have public IPs so they cannot route to the internet without a NAT (gateway or instance).

Put them in a private subnet, ensure the private subnet's default route is a NAT in a public subnet, that the NAT has a public IP, and that the VPC has an IGW.

For more, see [this Stack Overflow question](https://stackoverflow.com/questions/52992085/why-cant-an-aws-lambda-function-inside-a-public-subnet-in-a-vpc-connect-to-the).


---

### Answer by username_3 on 2018-09-24. Score: 2

Provided the *Public Subnet* where you're launching your Lambda is configured with **Auto-assign public IPv4 address: Yes** it should work in public a subnet without NAT.

Whether or not it's a good idea is another question. In general you shouldn't launch any backend services in the public subnets, the public subnets are for things like API Gateways, NAT Gateways, Load Balancers, etc. Not for launching the actual backend systems. That's the best security practice.

However that aside I'm pretty confident that with *auto-assign IPv4 address* enabled Lambdas will work even in the public subnet.

Unless you want the Lambda to connect to any VPC-internal resources (e.g. to your RDS) you may just as well launch it without VPC config (leave those VPC and Subnet settings empty). That will give it access to the internet without having to worry about NAT or public IPs.

Hope that helps

> **Comments:**
> **username_4**: I tried configuring the lambda to be in a public subnet with `Auto-assign public IPv4 address: Yes` but I don't think it was able to connect to the internet. The public subnet also has an IGW at 0.0.0.0/0 in the routing table.  
> **username_5**: @LeoLei here's some checklist items... 1 check the VPC network ACL (ensure inbound & outbound is enabled for TCP over port 443 (https)) ,, 2 check the Lambda security group, ensure outbound TCP over port 443 is enabled ,, 3 check the VPC route table, ensure a default route to the IGW is available  
> **username_2**: No, Lambda functions do not get a public IP, regardless of the auto-assign IPv4 address setting. They cannot have public IPs. To reach the internet, they must route through a NAT (which routes to an IGW).  

---

