CloudFormation Response Object Timeout

Question

I've got a CloudFormation Lambda Backed Custom Resource , Lambda function in public subnets but when I check the cloudWatch logs shown it below

Log-Message#1

Starting new HTTPS connection (1): cloudformation-custom-resource-response-eucentral1.s3.eu-central-1.amazonaws.com

Log-Message#2

Task timed out after 30.03 seconds

How I can handle this problem , my cloudformation is shown as below .

 Resources:
 HelloWorld: #Custom Resource
Type: Custom::HelloWorld
Properties:
  ServiceToken:
    Fn::GetAtt:
    - TestFunction #Reference to Function to be run
    - Arn #ARN of the function to be run
  Input1:
    Ref: Message
 TestFunction: #Lambda Function
 Type: AWS::Lambda::Function
 Properties:
  Code:
    S3Bucket:
      Ref: S3Bucket
    S3Key:
      Ref: S3Key
  Handler:
    Fn::Join:
    - ''
    - - Ref: ModuleName
      - ".lambda_handler"
  Role:
    Fn::GetAtt:
    - LambdaExecutionRole
    - Arn
  VpcConfig:
    SecurityGroupIds:
      - !Ref SecurityGroup
    SubnetIds:
      - Fn::Select: [ 0, !Ref PublicSubnet1 ]
      - Fn::Select: [ 0, !Ref PublicSubnet2 ]
  Runtime: python2.7
  Timeout: '30'
   LambdaExecutionRole: #IAM Role for Custom Resource
Type: AWS::IAM::Role
Properties:
  AssumeRolePolicyDocument:
    Version: '2012-10-17'
    Statement:
    - Effect: Allow
      Principal:
        Service:
        - lambda.amazonaws.com
      Action:
      - sts:AssumeRole
  Path: "/"
  Policies:
  - PolicyName: root
    PolicyDocument:
      Version: '2012-10-17'
      Statement:
      - Effect: Allow
        Action:
        - logs:CreateLogGroup
        - logs:CreateLogStream
        - logs:PutLogEvents
        Resource: arn:aws:logs:*:*:*
      - Effect: Allow
        Action:
        - ec2:CreateNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DeleteNetworkInterface

        Resource: "*"

   SecurityGroup:
   Type: AWS::EC2::SecurityGroup
   Properties:
    GroupName: "sec_group_name"
    GroupDescription: "SSH traffic in, all traffic out."
    VpcId: !Ref VPC
    SecurityGroupIngress:
      - IpProtocol: -1
        CidrIp: 0.0.0.0/0
    SecurityGroupEgress:
      - IpProtocol: -1
        CidrIp: 0.0.0.0/0

My subnets routing table associated with InternetGateway, but it giving CloudFormationResponse object error , How I can solve this connection problem .

Help ! Thanks :))

I don't have the exact solution, but this might be helpful github.com/aws-cloudformation/custom-resource-helper — Milan Cermak
– Milan Cermak, Commented Mar 13, 2019 at 12:49

asr9 · Accepted Answer · 2019-03-13 13:54:31Z

1

I am guessing your public subnet does not have a NAT gateway or NAT instance attached to it (InternetGateway alone is not enogh). As per AWS, this is required. If your functions does not need general internet access but access to AWS resources, you should consider VPC Endpoints. They are cheaper, but not sure if available for all resources.

answered Mar 13, 2019 at 13:54

asr9

2,8083 gold badges26 silver badges41 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

ColossusMark1 Over a year ago

I've created VPC Endpoint and attached it to the LambdaVPC , now I'm getting Forbidden error probably I will attach new role to lambda to access S3 bucket . this will fix this . Thanks :)

Collectives™ on Stack Overflow

CloudFormation Response Object Timeout

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related