Networking

You configure network access for your AWS Lambda MicroVMs by associating Network Connector resources with your MicroVM at run time. Network connectors are specified when you call run-microvm and cannot be changed while a MicroVM is running.

Overview

Each MicroVM can have independent ingress (inbound) and egress (outbound) network configurations:

A single connector can be reused across many MicroVMs – this is the intended usage pattern.

Inbound connectivity

Each Lambda MicroVM is reachable at a unique HTTPS endpoint URL, assigned when you call run-microvm. Clients send requests to this endpoint over HTTPS. Lambda routes each request to a port inside your MicroVM, where your application receives it.

By default, requests received at the endpoint are routed to port 8080 inside the MicroVM. To route to a different port, see Port routing.

The following protocols are supported on the inbound endpoint:

Port routing

Lambda selects the target port inside your MicroVM using the following order of priority:

Authentication

All requests to a MicroVM endpoint require a valid authentication token in the X-aws-proxy-auth header. You generate tokens using create-microvm-auth-token. Each token is an encrypted JWE (JSON Web Encryption) string scoped to:

The following example creates a token and uses it to send an authenticated request:

aws lambda-microvms create-microvm-auth-token \
  --microvm-identifier microvm-id \
  --expiration-in-minutes 30 \
  --allowed-ports '[{"port":8080}]'

curl 'https://microvm-endpoint' \
  -H 'X-aws-proxy-auth: TOKEN' \
  -H 'X-aws-proxy-port: 8080'

For a complete walkthrough of creating tokens and connecting to a MicroVM, including WebSocket connections, see Connecting to a MicroVM.

Error responses

The following HTTP status codes are returned by the MicroVM endpoint when it cannot process or deliver a request to your application. These responses come from the endpoint, not from your application.

Request headers

The X-aws-proxy-* header namespace is reserved by Lambda for request metadata, such as the authentication token (X-aws-proxy-auth) and target port (X-aws-proxy-port). Lambda removes X-aws-proxy-* headers before forwarding the request to your application.

Request/response bandwidth

Each Lambda MicroVM has a request/response bandwidth that scales linearly with its size. This bandwidth applies to all traffic through the MicroVM endpoint, both inbound requests and outbound responses.

If you experience increased request latency due to network saturation, either reduce your request concurrency or payload size, or select a larger MicroVM size to increase the available bandwidth.

HTTP/2 support

Lambda MicroVMs supports HTTP/2 on the inbound endpoint. Lambda negotiates the protocol through ALPN (Application-Layer Protocol Negotiation) during the TLS handshake, preferring HTTP/2 and falling back to HTTP/1.1. An HTTP/2-capable client uses it automatically.

To use HTTP/2 between the endpoint and your application inside the MicroVM:

Outbound connectivity

By default, Lambda MicroVMs have public internet access on the egress path. To connect MicroVMs with resources in your private VPCs – such as RDS, ElastiCache, internal APIs, and on-premises systems through Direct Connect or VPN – create a Lambda Network Connector with your VPC configuration.

When using VPC egress, outbound traffic is subject to security group rules and network ACLs governing traffic in your VPC.

Working with egress network connectors

Egress network connectors route outbound traffic from your MicroVM through your VPC. You create a connector once, then reference it by ARN when starting MicroVMs through the run-microvm command.

Prerequisites

Before creating a network connector, you need an IAM role that allows Lambda to create elastic network interfaces (ENIs) in your VPC. The role requires the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CreateENI",
      "Effect": "Allow",
      "Action": "ec2:CreateNetworkInterface",
      "Resource": [
        "arn:aws:ec2:*:*:network-interface/*",
        "arn:aws:ec2:*:*:subnet/*",
        "arn:aws:ec2:*:*:security-group/*"
      ]
    },
    {
      "Sid": "TagENI",
      "Effect": "Allow",
      "Action": "ec2:CreateTags",
      "Resource": "arn:aws:ec2:*:*:network-interface/*",
      "Condition": {
        "StringEquals": {
          "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com"
        }
      }
    }
  ]
}

Creating a network connector

Create a connector by specifying your VPC subnets, security groups, and network protocol (IPv4 or DualStack):

aws lambda-core create-network-connector \
  --name my-connector \
  --configuration '{
    "VpcEgressConfiguration": {
      "SubnetIds": ["subnet-xxx"],
      "SecurityGroupIds": ["sg-xxx"],
      "NetworkProtocol": "IPv4",
      "AssociatedComputeResourceTypes": ["MicroVm"]
    }
  }' \
  --operator-role arn:aws:iam::123456789012:role/NetworkConnectorOperatorRole

Network connector states

A connector must be in ACTIVE state before you can reference it in run-microvm.

Running a MicroVM with a network connector

Reference the connector ARN when running a MicroVM:

aws lambda-microvms run-microvm \
  --image-identifier arn:aws:lambda:us-east-1:123456789012:microvm-image:my-microvm-image \
  --egress-network-connectors connector-arn \
  --idle-policy '{"maxIdleDurationSeconds":900,"suspendedDurationSeconds":1800,"autoResumeEnabled":false}'

Using Lambda MicroVMs with interface VPC endpoints (AWS PrivateLink)

You can use AWS PrivateLink for private connectivity over the AWS network between your VPC resources and Lambda MicroVMs, without traversing the public internet. MicroVMs supports two VPC endpoints, depending on the desired traffic destination:

VPC endpoint for MicroVM management APIs

Lambda MicroVMs shares the same VPC endpoint service as Lambda (com.amazonaws.region.lambda). For full instructions, see Creating an interface endpoint for Lambda.

Endpoint policy for MicroVM management APIs

To control who can use your interface endpoint and which Lambda MicroVMs API actions they can perform, attach an endpoint policy. The policy specifies the principal that can perform actions, the actions they can perform, and the resources they can act on. Lambda MicroVMs actions use the lambda: IAM action prefix.

For more information, see Controlling access to services with VPC endpoints in the Amazon VPC User Guide.

The following example policy allows user MyUser to list and get MicroVM images through the endpoint:

{
  "Statement": [
    {
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:user/MyUser"
      },
      "Effect": "Allow",
      "Action": [
        "lambda:ListMicrovmImages",
        "lambda:GetMicrovmImage"
      ],
      "Resource": "*"
    }
  ]
}

VPC endpoint for MicroVM connectivity

To keep HTTPS traffic to your running MicroVMs private, create an interface endpoint for the com.amazonaws.region.lambda-microvm service. This endpoint handles connections to MicroVM endpoint URLs (for example, abc123def456.lambda-microvm.us-east-1.on.aws).

To learn more about interface endpoint properties, review the interface endpoints guide in the Amazon VPC documentation.

Creating the endpoint

To create an interface endpoint for MicroVM connectivity (console)

To use the private DNS option, you must set the enableDnsHostnames and enableDnsSupport attributes of your VPC. For more information, see Viewing and updating DNS support for your VPC in the Amazon VPC User Guide.

To create an interface endpoint for MicroVM connectivity (AWS CLI)

aws ec2 create-vpc-endpoint \
  --vpc-id vpc-ec43eb89 \
  --vpc-endpoint-type Interface \
  --service-name com.amazonaws.us-east-1.lambda-microvm \
  --subnet-id subnet-abababab \
  --security-group-id sg-1a2b3c4d \
  --private-dns-enabled

To verify that the endpoint is available and that private DNS is in effect:

aws ec2 describe-vpc-endpoints \
  --vpc-endpoint-ids vpce-1a2b3c4d5e6f7g8h9 \
  --query 'VpcEndpoints[0].{State:State,PrivateDns:PrivateDnsEnabled,Dns:DnsEntries[*].DnsName}'

Private DNS behavior

When private DNS is enabled – The endpoint manages DNS resolution for *.lambda-microvm.region.on.aws inside your VPC. Your existing MicroVM endpoint hostnames (for example, abc123def456.lambda-microvm.us-east-1.on.aws) resolve to the private IP addresses of the endpoint network interfaces. No client change is required.

When private DNS is disabled – Amazon VPC generates an endpoint-specific DNS name for your endpoint in the form vpce-id-hash.lambda-microvm.region.vpce.amazonaws.com. To route traffic through this endpoint while still reaching the correct MicroVM, you must preserve the original MicroVM hostname in two places:

If either value is set to the VPC endpoint hostname instead of the MicroVM hostname, the connection cannot be routed to the correct MicroVM.

Example: Connect through an endpoint-specific DNS name

The following example uses curl with the --connect-to flag to redirect the TCP connection to your VPC endpoint while keeping the MicroVM hostname in the URL, SNI, and Host header:

ENDPOINT_HOST=abc123def456.lambda-microvm.us-east-1.on.aws
VPCE_HOST=vpce-0a1b2c3d4e5f67890-a1b2c3d4.lambda-microvm.us-east-1.vpce.amazonaws.com

curl --connect-to "$ENDPOINT_HOST:443:$VPCE_HOST:443" \
  -H "x-aws-proxy-auth: $MICROVM_AUTH_TOKEN" \
  -H "x-aws-proxy-port: 8080" \
  "https://$ENDPOINT_HOST/"

The --connect-to flag tells curl to open the TCP connection to the VPC endpoint address, while the URL, TLS SNI, and Host header remain set to your MicroVM hostname.

For more information, see Accessing a service through an interface endpoint in the Amazon VPC User Guide.

Endpoint policy for MicroVM connectivity

You can attach an endpoint policy to control which MicroVMs are reachable through the lambda-microvm VPC endpoint. An endpoint policy on the lambda-microvm service lets you scope connections to specific accounts or organizations. By default, the endpoint allows connections to MicroVMs in any AWS account. (Note: The client establishing the connection must still hold a valid MicroVM auth token to be granted access).

By default, a VPC endpoint has a full-access policy that allows all traffic. When you replace the default policy with a custom policy, Lambda MicroVMs evaluates that policy against the lambda:ConnectMicrovm action on every connection made through the endpoint. If the policy does not allow connecting to MicroVMs, the connection is rejected with an HTTP 403 Forbidden response. A policy that does not grant lambda:ConnectMicrovm denies all connections through the endpoint.

Principal and resource

Connections to a MicroVM endpoint are authenticated with a MicroVM auth token rather than AWS Signature Version 4. For this reason, no IAM principal is associated with the connection. Instead, Lambda MicroVMs evaluates the endpoint policy with an anonymous principal. This means:

Supported condition keys

Example: Allow connections only to MicroVMs in your own account

The following endpoint policy allows connections through the endpoint only to MicroVMs owned by account 111122223333. Connections to MicroVMs owned by any other account are denied.

{
  "Statement": [
    {
      "Principal": "*",
      "Effect": "Allow",
      "Action": "lambda:ConnectMicrovm",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "111122223333"
        }
      }
    }
  ]
}