AWS lambda documentation change
Summary
Added documentation for troubleshooting intermittent TCP/UDP connection failures in VPC subnets using network ACLs, specifying required ephemeral port ranges
Security assessment
The change adds guidance about configuring network ACLs (a security feature) to allow ephemeral ports 1024-65535 for Lambda hyperplane ENIs. While this prevents operational issues, there is no evidence it addresses a specific security vulnerability. It improves security documentation by clarifying proper NACL configuration.
Diff
diff --git a/lambda/latest/dg/troubleshooting-networking.md b/lambda/latest/dg/troubleshooting-networking.md index 17167b787..49591af15 100644 --- a//lambda/latest/dg/troubleshooting-networking.md +++ b//lambda/latest/dg/troubleshooting-networking.md @@ -5 +5 @@ -VPC: Function loses internet access or times outVPC: Function needs access to AWS services without using the internetVPC: Elastic network interface limit reachedEC2: Elastic network interface with type of "lambda"DNS: Fail to connect to hosts with UNKNOWNHOSTEXCEPTION +VPC: Function loses internet access or times outVPC: TCP or UDP connection intermittently failsVPC: Function needs access to AWS services without using the internetVPC: Elastic network interface limit reachedEC2: Elastic network interface with type of "lambda"DNS: Fail to connect to hosts with UNKNOWNHOSTEXCEPTION @@ -16,0 +17,2 @@ Network connectivity errors can result from issues with your VPC's routing confi + * VPC: TCP or UDP connection intermittently fails + @@ -40 +42,11 @@ When you connect a function to a VPC, all outbound requests go through the VPC. -If some of your TCP connections are timing out, this may be due to packet fragmentation. Lambda functions cannot handle incoming fragmented TCP requests, since Lambda does not support IP fragmentation for TCP or ICMP. +If some of your TCP connections are timing out, see VPC: TCP or UDP connection intermittently fails if your subnet is using a network access control list (NACL). Otherwise, this is likely due to packet fragmentation. Lambda functions cannot handle incoming fragmented TCP requests, since Lambda does not support IP fragmentation for TCP or ICMP. + +## VPC: TCP or UDP connection intermittently fails + +###### Note + +This issue applies only if your subnet uses a [network access control list (ACL)](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#nacl-basics). Network ACLs aren't required for Lambda to connect to your subnets. + +**Issue:** _Lambda intermittently loses connection to your VPC subnets, which you have configured a network access control list (ACL) for._ + +For VPC-enabled Lambda functions, AWS creates [hyperplane ENIs](./configuration-vpc.html#configuration-vpc-enis) in the customer's account, and uses ephemeral ports `1024` to `65535` to connect Lambda to the customer's VPC. If you use network ACLs in the target subnet, you must allow the port range `1024` to `65535` for both TCP and UDP. Not allowing this full port range can cause intermittent connection failures.