How can an S3 event trigger a Lambda Function in a VPC?

Question

I have one query. I tried to google it but could not find the answer specific to my query.

S3 is a global service. We can access it via the internet or using the VPC endpoint from our private network. That I understand.

If lambda functions are present inside VPC. Then how does s3 event trigger lambda functions?

Answer 1

You have to differentiate between the Lambda Service, a Lambda Function, and an Execution Context.

The Lambda service operates the Lambda functions, and an Execution Context is an instance of a Lambda Function. Only the Execution Context is located in the VPC. The rest of the components reside outside of it. The Lambda service can always communicate with the Execution Contexts of any particular Lambda Function to pass events to it and monitor the execution. It does that through a private channel and not through the VPC.

S3 is also not really a global service. The buckets and APIs reside in specific regions. It has a global namespace, meaning that bucket names have to be globally unique. This means some APIs will do "global checks", but when S3 acts, it acts inside of a region.

Let's talk through what happens in the S3-Lambda integration. When an event happens in a bucket (e.g. an object is created), the S3 service checks, which endpoints are interested in this event. If you want to send an event to a Lambda function, it has to be in the same region as the bucket. S3 will then contact the Lambda service and tell it to invoke the Lambda function with this specific event. S3 doesn't care about the results here.

This is where Lambda takes over. The service checks if S3 is permitted to invoke the function in question. If that's the case, it will check for existing Execution Contexts for that function that aren't busy. Once it finds one, it sends the event to the Execution Context, which is executed inside the VPC and can access resources in the VPC.

Assuming everything goes well, this is how it ends, otherwise, Lambda will retry the event in another Execution Context.

References

• AWS Docs: Using AWS Lambda with Amazon S3
• AWS Docs: Asynchronous Lambda Invocation