{"id":4138,"date":"2025-04-21T12:27:40","date_gmt":"2025-04-21T12:27:40","guid":{"rendered":"https:\/\/code2deploy.com\/blog\/?p=4138"},"modified":"2025-05-19T15:44:08","modified_gmt":"2025-05-19T15:44:08","slug":"how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking","status":"publish","type":"post","link":"https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/","title":{"rendered":"How I Secured AWS Lambda to MongoDB with VPC Peering, NAT Gateway &amp; Default VPC Networking"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">When building a secure serverless application, I recently ran into a classic AWS networking issue:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I needed my <strong>Lambda function<\/strong> to access <strong>MongoDB privately<\/strong> (hosted in a different VPC via VPC Peering), <strong>and<\/strong> I also needed Lambda to access the <strong>internet<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Simple? Not quite.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s how I solved it\u2014<strong>step by step<\/strong>, using:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\ud83c\udfd7\ufe0f <strong>AWS Default VPC<\/strong><strong><br><\/strong><\/li>\n\n\n\n<li>\ud83d\udd01 <strong>VPC Peering<\/strong><strong><br><\/strong><\/li>\n\n\n\n<li>\ud83d\udee3\ufe0f <strong>Custom Route Table<\/strong><strong><br><\/strong><\/li>\n\n\n\n<li>\ud83c\udf10 <strong>NAT Gateway<\/strong><strong><br><\/strong><\/li>\n\n\n\n<li>\ud83c\udf0e <strong>Private internet access for Lambda<\/strong><strong><br><\/strong><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\ud83d\udd0d The Problem<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After establishing VPC peering between the <strong>Lambda\u2019s VPC (default)<\/strong> and <strong>MongoDB\u2019s VPC<\/strong>, everything seemed fine:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u2705 Lambda could talk to MongoDB.<br><\/li>\n\n\n\n<li>\u274c Lambda lost internet access!<br><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Which broke all third-party API calls.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Turns out, when you attach Lambda to a <strong>VPC subnet<\/strong>, it <strong>loses internet access unless routed through a NAT Gateway<\/strong>\u2014even if the subnet is in a Default VPC with an Internet Gateway.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\ud83c\udfaf The Goal<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u2705 Lambda must access MongoDB <strong>privately<\/strong> via VPC peering.<br><\/li>\n\n\n\n<li>\u2705 Lambda must access the <strong>internet<\/strong> via a <strong>NAT Gateway<\/strong>.<br><\/li>\n\n\n\n<li>\u2705 MongoDB is hosted in a <strong>separate VPC<\/strong>.<br><\/li>\n\n\n\n<li>\u2705 Use the <strong>Default VPC<\/strong> to keep things simple.<br><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\u26a0\ufe0f Important Note on MongoDB Atlas<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">MongoDB Atlas <strong>does not support VPC peering<\/strong> for <strong>Serverless<\/strong>, <strong>Shared (M0\u2013M5)<\/strong>, or <strong>Flex clusters<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To use <strong>VPC peering<\/strong>, your MongoDB Atlas cluster must be <strong>M10 or higher<\/strong> (i.e., a <strong>dedicated cluster<\/strong>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;re on a lower tier:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u274c You can\u2019t set up VPC peering.<br><\/li>\n\n\n\n<li>\u2705 You must instead use <strong>public access<\/strong> (with IP whitelisting and TLS).<br><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\u2699\ufe0f Step-by-Step Solution<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1\ufe0f\u20e3 VPC Peering: Connect Lambda VPC to MongoDB VPC<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>VPC \u2192 Peering Connections \u2192 Create<\/strong>.<br><\/li>\n\n\n\n<li>Choose:<br>\n<ul class=\"wp-block-list\">\n<li>Requester: Default VPC (Lambda\u2019s VPC).<br><\/li>\n\n\n\n<li>Accepter: MongoDB\u2019s VPC.<br><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Accept the connection in the MongoDB VPC.<br><\/li>\n\n\n\n<li><strong>Update both VPC route tables<\/strong> to include each other\u2019s CIDR blocks:<br>\n<ul class=\"wp-block-list\">\n<li>Lambda VPC: 10.1.0.0\/16 \u2192 pcx-xxxx<br><\/li>\n\n\n\n<li>MongoDB VPC: 172.31.0.0\/16 \u2192 pcx-xxxx<br><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2\ufe0f\u20e3 Create a Custom Public Subnet in Default VPC<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You can\u2019t modify the default subnet&#8217;s route table if it already uses 0.0.0.0\/0 with an Internet Gateway!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So instead:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Create a <strong>new subnet<\/strong>:<br>\n<ul class=\"wp-block-list\">\n<li>Name: LambdaPublicSubnet<br><\/li>\n\n\n\n<li>VPC: Default<br><\/li>\n\n\n\n<li>CIDR block: 172.31.100.0\/24<br><\/li>\n\n\n\n<li>AZ: (choose any available)<br><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Enable <strong>auto-assign public IP<\/strong>.<br><\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3\ufe0f\u20e3 Create a Custom Route Table (Not Default)<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Route Tables \u2192 Create<\/strong>.<br>\n<ul class=\"wp-block-list\">\n<li>Name: LambdaCustomRT<br><\/li>\n\n\n\n<li>VPC: Default<br><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Add routes:<br>\n<ul class=\"wp-block-list\">\n<li>0.0.0.0\/0 \u2192 <strong>NAT Gateway<\/strong> (you\u2019ll create this next).<br><\/li>\n\n\n\n<li>MongoDB CIDR (e.g., 10.1.0.0\/16) \u2192 <strong>Peering Connection ID<\/strong><strong><br><\/strong><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Associate this route table with the LambdaPublicSubnet.<br><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">\u26a0\ufe0f This is key:<br>You <strong>cannot add<\/strong> another 0.0.0.0\/0 \u2192 NAT Gateway to the <strong>default route table<\/strong>, because it already has one pointing to an Internet Gateway. So you <strong>must use a custom route table<\/strong> for NAT routing.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>4\ufe0f\u20e3 Create a NAT Gateway<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>NAT Gateways \u2192 Create NAT Gateway<\/strong>.<br><\/li>\n\n\n\n<li>Attach it to:<br>\n<ul class=\"wp-block-list\">\n<li><strong>Subnet<\/strong>: Your LambdaPublicSubnet<br><\/li>\n\n\n\n<li><strong>Elastic IP<\/strong>: Allocate a new one<br><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Wait for the status to become <strong>Available<\/strong>.<br><\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>5\ufe0f\u20e3 Attach Lambda to VPC + Subnet<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to your <strong>Lambda function \u2192 Configuration \u2192 VPC<\/strong>.<br><\/li>\n\n\n\n<li>Attach:<br>\n<ul class=\"wp-block-list\">\n<li><strong>Subnet<\/strong>: LambdaPublicSubnet (or more if needed)<br><\/li>\n\n\n\n<li><strong>Security Group<\/strong>: Allow outbound to MongoDB + Internet (443)<br><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Save the configuration.<br><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Lambda will now:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Privately connect to MongoDB via VPC Peering.<br><\/li>\n\n\n\n<li>Access the internet via the NAT Gateway.<br><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\ud83d\udd10 Security Group Rules<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Lambda SG<\/strong>:<br>\n<ul class=\"wp-block-list\">\n<li>Outbound: allow 0.0.0.0\/0 on ports 443 (HTTPS), 27017 (Mongo)<br><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>MongoDB SG<\/strong>:<br>\n<ul class=\"wp-block-list\">\n<li>Inbound: allow 27017 from Lambda subnet range (e.g., 172.31.100.0\/24)<br><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\ud83d\udcca Final Architecture<\/strong><\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>[ Lambda ]<br>&nbsp; | (Private Subnet)<br>&nbsp; |<br>[ NAT Gateway ]<br>&nbsp; |<br>[ Internet ]<br><br>[ Lambda ]<br>&nbsp; |<br>[ VPC Peering ]<br>&nbsp; |<br>[ MongoDB VPC \/ EC2 ]<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\u2705 Key Lessons Learned<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\ud83e\udded You <strong>can\u2019t route 0.0.0.0\/0 to both IGW and NATGW<\/strong> in the same route table.<br><\/li>\n\n\n\n<li>\ud83d\udd27 So you need a <strong>custom route table<\/strong> + <strong>custom subnet<\/strong>.<br><\/li>\n\n\n\n<li>\ud83d\udee3\ufe0f Default VPC\u2019s route table points to Internet Gateway, so it\u2019s not usable for NAT.<br><\/li>\n\n\n\n<li>\ud83d\udce1 NAT Gateway must be placed in a <strong>public subnet<\/strong> (associated with a custom route table).<br><\/li>\n\n\n\n<li>\ud83d\udd10 Lambda in a VPC doesn\u2019t get public IPs, so NAT is required for outbound internet.<br><\/li>\n\n\n\n<li>\ud83e\udde9 MongoDB Atlas VPC peering only works with <strong>M10 or higher<\/strong> (dedicated tiers).<br><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\ud83e\uddea Debugging Tip<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If Lambda still can&#8217;t access the internet:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Make sure it&#8217;s attached to the <strong>custom subnet<\/strong><strong><br><\/strong><\/li>\n\n\n\n<li>Ensure the route table is correctly associated with the subnet<br><\/li>\n\n\n\n<li>Confirm the NAT Gateway is <strong>Available<\/strong> and using a valid EIP<br><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\ud83d\ude4c That\u2019s It!<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This pattern is useful not just for MongoDB but for <strong>any private resource in a peered VPC<\/strong>\u2014while keeping Lambda&#8217;s public internet access functional and secure.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When building a secure serverless application, I recently ran into a classic AWS networking issue: I needed my Lambda function to access MongoDB privately (hosted in a different VPC via VPC Peering), and I also needed Lambda to access the internet. Simple? Not quite. Here\u2019s how I solved it\u2014step by step, using: \ud83d\udd0d The Problem [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[649,133,116,117,20,648],"tags":[652,650,188,654,655,653,651],"class_list":["post-4138","post","type-post","status-publish","format-standard","hentry","category-aws-lambda","category-cloud-security","category-database","category-mongodb","category-cyber-security","category-serverless","tag-aws-lambda","tag-lambda-function","tag-mongodb","tag-nat-gateway","tag-private-internet-access-for-lambda","tag-secure-serverless-application","tag-vpc-peering"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How I Secured AWS Lambda to MongoDB with VPC Peering, NAT Gateway &amp; Default VPC Networking - code2deploy.com<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How I Secured AWS Lambda to MongoDB with VPC Peering, NAT Gateway &amp; Default VPC Networking - code2deploy.com\" \/>\n<meta property=\"og:description\" content=\"When building a secure serverless application, I recently ran into a classic AWS networking issue: I needed my Lambda function to access MongoDB privately (hosted in a different VPC via VPC Peering), and I also needed Lambda to access the internet. Simple? Not quite. Here\u2019s how I solved it\u2014step by step, using: \ud83d\udd0d The Problem [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/\" \/>\n<meta property=\"og:site_name\" content=\"code2deploy.com\" \/>\n<meta property=\"article:published_time\" content=\"2025-04-21T12:27:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-19T15:44:08+00:00\" \/>\n<meta name=\"author\" content=\"enam\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"enam\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\\\/\"},\"author\":{\"name\":\"enam\",\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/#\\\/schema\\\/person\\\/e46930c19b999a87f12566fa8357481b\"},\"headline\":\"How I Secured AWS Lambda to MongoDB with VPC Peering, NAT Gateway &amp; Default VPC Networking\",\"datePublished\":\"2025-04-21T12:27:40+00:00\",\"dateModified\":\"2025-05-19T15:44:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\\\/\"},\"wordCount\":687,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/#\\\/schema\\\/person\\\/e46930c19b999a87f12566fa8357481b\"},\"keywords\":[\"AWS Lambda\",\"Lambda function\",\"MongoDB\",\"NAT Gateway\",\"Private internet access for Lambda\",\"secure serverless application\",\"VPC Peering\"],\"articleSection\":[\"AWS Lambda\",\"Cloud Security\",\"Database\",\"MongoDB\",\"Security\",\"Serverless\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/code2deploy.com\\\/blog\\\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\\\/\",\"url\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\\\/\",\"name\":\"How I Secured AWS Lambda to MongoDB with VPC Peering, NAT Gateway &amp; Default VPC Networking - code2deploy.com\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/#website\"},\"datePublished\":\"2025-04-21T12:27:40+00:00\",\"dateModified\":\"2025-05-19T15:44:08+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/code2deploy.com\\\/blog\\\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How I Secured AWS Lambda to MongoDB with VPC Peering, NAT Gateway &amp; Default VPC Networking\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/\",\"name\":\"code2deploy.com\\\/blog\",\"description\":\"TechOps\",\"publisher\":{\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/#\\\/schema\\\/person\\\/e46930c19b999a87f12566fa8357481b\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/#\\\/schema\\\/person\\\/e46930c19b999a87f12566fa8357481b\",\"name\":\"enam\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g\",\"caption\":\"enam\"},\"logo\":{\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g\"},\"sameAs\":[\"https:\\\/\\\/code2deploy.com\\\/blog\"],\"url\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/author\\\/enam\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How I Secured AWS Lambda to MongoDB with VPC Peering, NAT Gateway &amp; Default VPC Networking - code2deploy.com","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/","og_locale":"en_US","og_type":"article","og_title":"How I Secured AWS Lambda to MongoDB with VPC Peering, NAT Gateway &amp; Default VPC Networking - code2deploy.com","og_description":"When building a secure serverless application, I recently ran into a classic AWS networking issue: I needed my Lambda function to access MongoDB privately (hosted in a different VPC via VPC Peering), and I also needed Lambda to access the internet. Simple? Not quite. Here\u2019s how I solved it\u2014step by step, using: \ud83d\udd0d The Problem [&hellip;]","og_url":"https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/","og_site_name":"code2deploy.com","article_published_time":"2025-04-21T12:27:40+00:00","article_modified_time":"2025-05-19T15:44:08+00:00","author":"enam","twitter_card":"summary_large_image","twitter_misc":{"Written by":"enam","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/#article","isPartOf":{"@id":"https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/"},"author":{"name":"enam","@id":"https:\/\/code2deploy.com\/blog\/#\/schema\/person\/e46930c19b999a87f12566fa8357481b"},"headline":"How I Secured AWS Lambda to MongoDB with VPC Peering, NAT Gateway &amp; Default VPC Networking","datePublished":"2025-04-21T12:27:40+00:00","dateModified":"2025-05-19T15:44:08+00:00","mainEntityOfPage":{"@id":"https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/"},"wordCount":687,"commentCount":0,"publisher":{"@id":"https:\/\/code2deploy.com\/blog\/#\/schema\/person\/e46930c19b999a87f12566fa8357481b"},"keywords":["AWS Lambda","Lambda function","MongoDB","NAT Gateway","Private internet access for Lambda","secure serverless application","VPC Peering"],"articleSection":["AWS Lambda","Cloud Security","Database","MongoDB","Security","Serverless"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/","url":"https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/","name":"How I Secured AWS Lambda to MongoDB with VPC Peering, NAT Gateway &amp; Default VPC Networking - code2deploy.com","isPartOf":{"@id":"https:\/\/code2deploy.com\/blog\/#website"},"datePublished":"2025-04-21T12:27:40+00:00","dateModified":"2025-05-19T15:44:08+00:00","breadcrumb":{"@id":"https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/code2deploy.com\/blog\/how-i-secured-aws-lambda-to-mongodb-with-vpc-peering-nat-gateway-default-vpc-networking\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/code2deploy.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How I Secured AWS Lambda to MongoDB with VPC Peering, NAT Gateway &amp; Default VPC Networking"}]},{"@type":"WebSite","@id":"https:\/\/code2deploy.com\/blog\/#website","url":"https:\/\/code2deploy.com\/blog\/","name":"code2deploy.com\/blog","description":"TechOps","publisher":{"@id":"https:\/\/code2deploy.com\/blog\/#\/schema\/person\/e46930c19b999a87f12566fa8357481b"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/code2deploy.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/code2deploy.com\/blog\/#\/schema\/person\/e46930c19b999a87f12566fa8357481b","name":"enam","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g","caption":"enam"},"logo":{"@id":"https:\/\/secure.gravatar.com\/avatar\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g"},"sameAs":["https:\/\/code2deploy.com\/blog"],"url":"https:\/\/code2deploy.com\/blog\/author\/enam\/"}]}},"_links":{"self":[{"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/posts\/4138","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/comments?post=4138"}],"version-history":[{"count":3,"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/posts\/4138\/revisions"}],"predecessor-version":[{"id":4223,"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/posts\/4138\/revisions\/4223"}],"wp:attachment":[{"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/media?parent=4138"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/categories?post=4138"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/tags?post=4138"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}