在私有VPC中使用SQS作为lambda的Eventsource-我是否需要SQS VPC端点？
我一直在尝试阅读此信息，但是我得到的信息要么是矛盾的，要么我不太了解，以了解为什么没有冲突。
我正在使用CDK在VPC中设置Lambda，并以SQS队列作为事件源。 SQS队列将在不同的AWS帐户中订阅SNS主题。现在，我的问题就在SQS/Lambda互动后面。
我希望Lambda能够在不通过公共互联网的情况下从SQS队列中进行轮询/接收消息。首先，我认为这需要VPC/安全组设置来访问SQS VPC端点。但是我读了另一篇文章，有人说Lambda民意调查器本身并未在您的Lambda的VPC中运行，因此不会适用VPC配置。如果这样的人只能在AWS的私人“全球基础架构”中运作？
但这只是民意调查 - 我也想知道投票是否找到消息，lambda是否也能够阅读和响应（例如，假设lambda抛出了例外，或者我想返回部分批处理响应 - 在这两种情况下 - lambda lambda内置功能是否可以将消息返回到VPC之外，在非公开互联网上也可以处理
。 发布 to sqs，或者在用作sqs用作lambda Eventsource时，从队列中手动阅读消息。
I've been trying to read up on this, but the info I'm getting is either conflicting or I just don't understand well enough to see why there's no conflict.
I'm using CDK to set up a lambda in a vpc with an SQS queue as an event source. The SQS queue will be subscribed to SNS topics in different AWS accounts. For now my question is just behind the SQS/Lambda interaction.
I want the Lambda to be able to poll/receive messages from the SQS queue without going through public internet. At first I thought this would require the vpc/security group setup for access to SQS vpc endpoint. But I read another post where someone was saying the lambda poller itself is not running in your lambda's VPC so no vpc configuration would apply to it. If so- does the poller only operate in AWS's private 'global infrastructure'?
But that's just the polling- I'm also wondering if the polling finds messages, is the lambda also able to read and respond (e.g. let's say the lambda throws an exception, or I want to return a partial batch response- in both cases Lambda has built-in functionality to return messages to the queue. Would all this also be handled outside the VPC, on non-public internet?
I'm wondering because pretty much 100% of the documentation/examples I've found only talk about lambda publishing to SQS, or manually reading a message from the queue- not when SQS is used as a lambda eventSource.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
只要我们只谈论触发 to lambda函数，您就不需要VPC端点。
您必须区分 lambda服务， lambda函数和执行上下文。 Lambda服务在AWS后端的某个地方运行，并管理Lambda功能。如果您已将SQS配置为Lambda功能的触发器，则Lambda服务将定期对新消息进行轮询SQ，一旦获得了以下操作。
首先，它检查Lambda函数的任何执行上下文是否可用，即不忙于在另一个事件上工作。如果事实并非如此，它将创建lambda函数的新执行上下文或实例，该函数位于VPC中的部分 。
您在执行上下文中运行的代码可以通过共享的弹性网络接口访问VPC（现实中更复杂）。这是安全组应用的地方。它适用于所有 you 在执行上下文中执行的操作。 AWS有另一个私人渠道可以与执行上下文进行通信。这用于传递事件并接受Lambda功能的响应。
tl; dr：要触发lambda函数，您将不需要VPC端点，如果您想直接与代码的服务交谈，则需要一个。
As long as we're only talking about the trigger to the Lambda function, you don't need a VPC Endpoint.
You have to distinguish between the Lambda service, a Lambda function, and the Execution Context. The Lambda service runs somewhere in the AWS backend and manages Lambda functions. If you've configured SQS as the trigger for a Lambda function, the Lambda service will periodically poll SQS for new messages, and once it gets some does the following.
First, it checks if any of the Execution Contexts for the Lambda function is available, i.e., not busy working on another event. If that's not the case, it will create a new Execution Context or instance of your Lambda function, which is partially located in the VPC.
Your code running inside the Execution Context has access to the VPC through a shared Elastic Network Interface (a bit more complex in reality). This is where the security group applies. It applies to everything you do inside the Execution Context. AWS has another private channel to communicate with the Execution Context. This is used to pass events and accept responses from Lambda functions.
tl;dr: To trigger a Lambda function, you won't need a VPC Endpoint, if you want to directly talk to a service from your code, you will need one.