How traffic leaves a VPC
Every subnet has a route table, and the route for 0.0.0.0/0 decides where traffic to anything outside the VPC goes. That route, not the subnet's name, is what makes a subnet public or private:
| 0.0.0.0/0 goes to | The subnet is | What reaches the internet and AWS services |
|---|---|---|
An internet gateway (igw-) | Public | Only resources with a public IP address: EC2 instances with a public IPv4 or Elastic IP, Fargate tasks with assignPublicIp enabled. Never a Lambda function. |
A NAT gateway (nat-) | Private | Everything in the subnet, outbound only. The NAT gateway itself sits in a public subnet. |
| Nothing | Private (isolated) | Only the VPC itself and the AWS services it has VPC endpoints for. |
The trap most people fall into: a Lambda function connected to a VPC gets network interfaces with private IP addresses only. Put it in a public subnet and its calls to the internet or to AWS APIs hang until the function times out. A function in a VPC needs private subnets with a NAT gateway, or VPC endpoints - or, if it needs nothing inside the VPC, no VPC at all: outside a VPC, Lambda reaches the internet by default.
Gateway and interface VPC endpoints
VPC endpoints let a private subnet call AWS services without a NAT gateway, and keep the traffic off the internet. There are two kinds:
| Gateway endpoint | Interface endpoint (AWS PrivateLink) | |
|---|---|---|
| Services | Amazon S3 and DynamoDB only | Most AWS services, S3 included |
| How it works | A route to the service's prefix list in the route tables you pick | Network interfaces with private IPs in your subnets; private DNS points the service's name at them |
| Cost | Free | Per hour per Availability Zone, and per GB |
| Security groups | The resource's outbound rules | The endpoint's own security group must allow inbound 443 |
| Reach | The VPC's own Region, from inside the VPC | Also from peered VPCs and on-premises networks |
Some services need several endpoints. Pulling an image from Amazon ECR takes ecr.api, ecr.dkr and the S3 gateway endpoint, because image layers are stored in S3; a Fargate task also needs logs for the awslogs driver, and secretsmanager or ssm for the secrets in its task definition. Session Manager needs ssm, ssmmessages and ec2messages. Even with a NAT gateway, the S3 and DynamoDB gateway endpoints are worth adding: they are free, and that traffic stops paying the NAT gateway's per-GB processing charge.
Connecting to an EC2 instance
| Method | Public IP | Inbound rule | Also needs |
|---|---|---|---|
| SSH or RDP from your computer | Yes | 22 or 3389 from your IP | The key pair, a route to an internet gateway |
| EC2 Instance Connect (console) | Yes | 22 from the Region's ec2-instance-connect prefix list | EC2 Instance Connect on the AMI |
| EC2 Instance Connect Endpoint | No | 22 or 3389 from the endpoint's security group | An endpoint in the VPC |
| Session Manager | No | None | SSM Agent, the AmazonSSMManagedInstanceCore role, outbound 443 to Systems Manager |
A NAT gateway does not make a private instance reachable: it carries outbound connections only. To get into a private instance, use Session Manager or an EC2 Instance Connect Endpoint rather than opening port 22.
VPC connectivity errors and what they mean
| Error | Most common cause |
|---|---|
| ResourceInitializationError: unable to pull secrets or registry auth | Fargate task without a route to ECR or Secrets Manager: no public IP, NAT gateway or endpoints |
| CannotPullContainerError ... i/o timeout | The same, or ECR endpoints without the S3 gateway endpoint |
| Task timed out after N seconds | Lambda in a VPC calling out without a NAT gateway or endpoint |
| Connect timeout on endpoint URL, connect ETIMEDOUT, dial tcp ... i/o timeout | No route to the service, or an interface endpoint without private DNS |
| The provided execution role does not have permissions to call CreateNetworkInterface on EC2 | The function's role lacks AWSLambdaVPCAccessExecutionRole |
| TargetNotConnected | SSM Agent offline: no instance role, or no way out to Systems Manager |
| ssh: connect to host ... port 22: Connection timed out | Security group, no public IP, or no route to an internet gateway |
| Connection refused | The instance was reached, but nothing listens on the port |
| Permission denied (publickey) | Wrong user name or key - the network works |
One rule sorts most of them: a timeout means the network - route, NAT gateway, endpoint, security group or network ACL. An AccessDenied means the network works and IAM says no. For a path you cannot work out, the VPC Reachability Analyzer traces it hop by hop and names the component that blocks it.
Frequently asked questions
Why can't my Lambda function in a public subnet reach the internet?
Lambda's network interfaces in a VPC never get public IP addresses, and an internet gateway only serves resources that have one. Move the function to private subnets that route to a NAT gateway, use VPC endpoints for the AWS services it calls, or take it out of the VPC.
Do I need a NAT gateway to access S3 from a private subnet?
No. An S3 gateway endpoint gives private subnets access to buckets in the same Region, and it is free. The same goes for DynamoDB. Buckets in other Regions still need a NAT gateway or an interface endpoint in their Region.
What does ResourceInitializationError mean on ECS Fargate?
The task could not fetch what it needs before starting - the ECR login, the image, or secrets - usually because its subnet has no way out: a public subnet without a public IP, or a private subnet without a NAT gateway or the ECR, S3 and Secrets Manager endpoints. If the message says AccessDenied, it is the task execution role instead.
Is it safe to paste an error message here?
Yes. Everything runs in your browser: nothing you enter is uploaded, processed on a server or stored. The page only counts which error it recognized and which path was looked at, never the text.
References
Enable internet access for VPC-connected Lambda functions
Gateway endpoints
Amazon ECR interface VPC endpoints
Amazon ECS interface VPC endpoints
Improve EC2 instance security with VPC endpoints for Systems Manager
Connect to an instance using EC2 Instance Connect Endpoint