How does networking work in AWS serverless applications?

Draw every ingress and egress path

For each request, record the source, DNS name, endpoint, protocol, port, identity, encryption, network boundary, and destination. Include callbacks, third-party APIs, package retrieval, telemetry, secrets, and control-plane calls, not only the primary business request.

Managed services often expose regional public endpoints protected by TLS and IAM. Public endpoint does not mean public data access, but requirements may still call for private routing through VPC endpoints or explicit egress controls.

Attach Lambda to a VPC for a specific private dependency

VPC attachment lets a function reach resources such as private database endpoints through selected subnets and security groups. It does not make the function itself directly reachable from the VPC; invocation still occurs through Lambda service integrations.

Choose subnets for routes and availability-zone coverage rather than labeling them private without examining route tables. Security groups should allow only the required destination and port, and the destination should allow the function's security group where supported.

Provide deliberate access to AWS and internet endpoints

A VPC-attached function needs a valid route to services it calls. NAT can provide internet and public AWS endpoint egress from private subnets, while gateway or interface VPC endpoints can provide private routes to supported AWS services.

Compare endpoint availability, DNS behavior, policy controls, data transfer, hourly and processing cost, IPv4 address needs, and failure dependencies. Adding a VPC without the required egress path is a common cause of timeouts.

Operate DNS, connections, capacity, and failure

Reuse connections where safe, bound connect and read timeouts, and retry only transient failures with backoff. Observe DNS errors, connection exhaustion, NAT or endpoint metrics, rejected flows, dependency latency, and subnet address capacity.

Test the loss or throttling of each network dependency. Private routing can improve control, but every NAT gateway, endpoint, resolver, firewall, and cross-Region link becomes part of availability and cost.