title: Lambda function within VPC doesn't have access to public Internet
body: <p>I am trying to make an outbound API request to a third-party service from within a Lambda function, but the function always times out without any error.</p>
  
  <p>This previously happened when trying to perform a <code>s3.putObject</code> operation within a different function (still within the same VPC / subnets), and I managed to get around that by adding an Endpoint with a service name <code>com.amazonaws.us-east-1.s3</code> and connecting it to the route table that is associated with the VPC that this Lambda function resides in.</p>
  
  <p>Within the Lambda dashboard inside Network box -> Security Groups section, I see this warning:</p>
  
  <blockquote>
    <p>When you enable VPC, your Lambda function will lose default internet
    access. If you require external internet access for your function,
    ensure that your security group allows outbound connections and that
    your VPC has a NAT gateway.</p>
  </blockquote>
  
  <p>I believe that this security group allows outbound connections, based off of the Outbound rules table right underneath:</p>
  
  <p><a href="https://i.stack.imgur.com/tqLOC.png" rel="noreferrer"><img src="https://i.stack.imgur.com/tqLOC.png" alt="enter image description here"></a></p>
  
  <p>For that second requirement, I can confirm this VPC has a NAT gateway, because on the VPC Dashboard, within NAT Gateways tab, the one that appears there has a VCP associated with it, and that VPC is the same one hosting the Lambda function.</p>
  
  <p>I followed a guide to create a <a href="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow-logs.html#flow-logs-basics" rel="noreferrer">Flow Log</a> to monitor traffic in and out of the VPC, hoping to see that those outbound requests are indeed rejected. However, after doing so and inspecting the CloudWatch logs, all of the records end in either <code>ACCEPT OK</code> or <code>NODATA</code>.</p>
  
  <p><a href="https://aws.amazon.com/premiumsupport/knowledge-center/internet-access-lambda-function/" rel="noreferrer">How can I grant internet access to my VPC Lambda function?</a> is the guide I originally tried to follow, but I got stuck on step 4 under <code>To create a public or private subnet</code>:</p>
  
  <blockquote>
    <ol start="4">
    <li><p>From the Change to: drop-down menu, choose an appropriate route table:
    For a private subnet, the default route should point to a NAT gateway
    or NAT instance:</p>
    
    <p>Destination: 0.0.0.0/0
    Target: nat-… (or eni-…)
    For a public subnet,
    the default route should point to an internet gateway:</p>
    
    <p>Destination: 0.0.0.0/0
    Target: igw-…</p></li>
    </ol>
  </blockquote>
  
  <p>For all four of the subnets within this VPC, clicking the drop-down to the right of <code>Change to:</code> only showed one option, the one already selected, <code>rtb-xxxxxxxx</code>. After clicking on the link to that route table, and clicking the Routes tab next to Summary, I see this:</p>
  
  <p><a href="https://i.stack.imgur.com/KbkMd.png" rel="noreferrer"><img src="https://i.stack.imgur.com/KbkMd.png" alt="enter image description here"></a></p>
  
  <p>What might I be doing wrong that is blocking the Lambda function's access to the Internet?</p>