VPC内Lambda调用SSM getParameter超时问题排查求助

我的Lambda部署在VPC中（可正常访问VPC内的Redis），但调用SSM的getParameter接口时出现超时异常。此前未部署在VPC时该功能正常。

代码示例（未放入VPC前可正常运行） #

final ClientOverrideConfiguration configuration = ClientOverrideConfiguration.builder()
    .apiCallTimeout(Duration.ofSeconds(5L))
    .apiCallAttemptTimeout(Duration.ofSeconds(5L))
    .build();

final SsmClient ssmClient = SsmClient.builder()
    .overrideConfiguration(configuration)
    .endpointOverride(URI.create("https://my-endpoint-here.amazonaws.com"))
    .build();

final GetParameterRequest request = GetParameterRequest.builder()
    .name(key)
    .build();

final GetParameterResponse response = ssmClient.getParameter(request);
return response.parameter().value();

异常信息 #

software.amazon.awssdk.core.exception.ApiCallTimeoutException: Client execution did not complete before the specified timeout configuration: 5000 millis
    at software.amazon.awssdk.core.exception.ApiCallTimeoutException$BuilderImpl.build(ApiCallTimeoutException.java:106)
    at software.amazon.awssdk.core.exception.ApiCallTimeoutException.create(ApiCallTimeoutException.java:38)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.generateApiCallTimeoutException(ApiCallTimeoutTrackingStage.java:156)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.handleInterruptedException(ApiCallTimeoutTrackingStage.java:144)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.translatePipelineException(ApiCallTimeoutTrackingStage.java:109)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:64)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:43)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallMetricCollectionStage.execute(ApiCallMetricCollectionStage.java:50)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallMetricCollectionStage.execute(ApiCallMetricCollectionStage.java:32)
    at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
    at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:37)
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:26)
    at software.amazon.awssdk.core.internal.http.AmazonSyncHttpClient$RequestExecutionBuilderImpl.execute(AmazonSyncHttpClient.java:210)
    at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.invoke(BaseSyncClientHandler.java:103)
    at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.doExecute(BaseSyncClientHandler.java:173)
    at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.lambda$execute$1(BaseSyncClientHandler.java:80)
    at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.measureApiCallSuccess(BaseSyncClientHandler.java:182)
    at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:74)
    at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:45)
    at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:53)
    at software.amazon.awssdk.services.ssm.DefaultSsmClient.getParameter(DefaultSsmClient.java:6325)

已完成的配置 #

• 为Lambda创建了安全组
• 创建了com.amazonaws.ap-northeast-1.ssm和com.amazonaws.ap-northeast-1.ssmmessages的VPC端点
• 将Lambda的安全组关联至该端点
• 为SSM客户端配置了自定义端点URL

疑问：仍出现超时异常，还需检查或配置哪些内容？无需NAT配置即可解决是否属实？仅靠VPC端点是否足够？

1. 验证VPC端点核心配置 #

• 端点类型：确认SSM的VPC端点是Interface类型（SSM仅支持该类型），而非Gateway类型。
• 子网关联：检查VPC端点是否关联了Lambda所在的所有子网，确保Lambda所在子网能访问到端点实例。
• 私有DNS启用：必须开启VPC端点的私有DNS功能，这是关键。开启后AWS会自动通过私有DNS将SSM请求路由到VPC端点，无需手动指定端点URL。

2. 安全组规则校验 #

• Lambda安全组出向：允许HTTPS（443端口）流量到VPC端点的安全组，或直接到端点所在子网的IP段。
• VPC端点安全组入向：允许来自Lambda安全组的HTTPS（443端口）流量。

3. 路由表检查 #

确认Lambda所在子网的路由表中，存在指向VPC端点的路由条目（AWS会自动创建，需确认未被误删），路由目标为VPC端点ID，目标地址为SSM服务的前缀列表com.amazonaws.ap-northeast-1.ssm。

4. 修正SSM客户端配置 #

如果启用了私有DNS，移除手动指定的endpointOverride，让SDK自动通过私有DNS解析端点。修改后的代码示例：

final ClientOverrideConfiguration configuration = ClientOverrideConfiguration.builder()
    .apiCallTimeout(Duration.ofSeconds(5L))
    .apiCallAttemptTimeout(Duration.ofSeconds(5L))
    .build();

final SsmClient ssmClient = SsmClient.builder()
    .overrideConfiguration(configuration)
    .region(Region.AP_NORTHEAST_1) // 指定正确的区域
    .build();

关于NAT配置的疑问 #

是的，仅靠VPC端点即可让VPC内的Lambda访问SSM服务，无需配置NAT网关或互联网网关。只要VPC端点配置正确，流量会在VPC内部路由，完全不需要走公网。

内容的提问来源于stack exchange，提问作者Mihails Kuzmins