AWS Lambda does not seem to get an private IP address - amazon-web-services

Question

I am testing the Vault Lambda Extension which allows to reads secrets from Hashicorp Vault without using tokens.
I therefore created a demo lambda function which use the layer "Vault Lambda Extension".
The lambda crashes before the python code is run.
Example of the execution result:
foo
Response
{
"errorType": "Extension.Crash",
"errorMessage": "RequestId: b16468f9-009c-4b1a-91ca-8b0899e01b7c Error: exit status 1"
}
Function Logs
2023-02-15T18:15:10.999Z [INFO] vault-lambda-extension: Initialising
2023-02-15T18:15:11.006Z [ERROR] Fatal error, exiting: error="error logging in to Vault: read tcp 169.254.76.1:39510->10.73.1.100:8200: read: connection reset by peer"
EXTENSION Name: vault-lambda-extension State: Started Events: []
2023-02-15T18:15:12.712Z [INFO] vault-lambda-extension: Initialising
2023-02-15T18:15:12.773Z [ERROR] Fatal error, exiting: error="error logging in to Vault: read tcp 169.254.76.1:39514->10.73.1.100:8200: read: connection reset by peer"
EXTENSION Name: vault-lambda-extension State: Started Events: []
START RequestId: b16468f9-009c-4b1a-91ca-8b0899e01b7c Version: $LATEST
RequestId: b16468f9-009c-4b1a-91ca-8b0899e01b7c Error: exit status 1
Extension.Crash
END RequestId: b16468f9-009c-4b1a-91ca-8b0899e01b7c
REPORT RequestId: b16468f9-009c-4b1a-91ca-8b0899e01b7c Duration: 1694.95 ms Billed Duration: 1695 ms Memory Size: 128 MB Max Memory Used: 24 MB
This lambda is our Dev VPC private subnet.
We are therefore expecting it would receive a private IP address of this subnet CIDR.
But as you can see the address IP of the lambda is 169.254.76.1 (which is a Link-local address, an address used by Linux when it is not able to set an private IP address ).
The role (modified) set for this lambda is
{
"partial": false,
"policies": [
{
"arn": "arn:aws:iam::123456789012:policy/aws_iam_policy_lambda_vault_lab",
"document": {
"Statement": [
{
"Action": [
"ec2:DescribeNetworkInterfaces",
"ec2:CreateNetworkInterface",
"ec2:DeleteNetworkInterface",
"ec2:DescribeInstances",
"ec2:AttachNetworkInterface",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:PutLogEvents",
"logs:GetLogEvents",
"logs:FilterLogEvents"
],
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
},
"id": "ANPATRANPATRANPATRANPAT",
"name": "aws_iam_policy_lambda_vault_lab",
"type": "managed"
}
],
"resources": {
"ec2": {
"service": {
"icon": "data:image/svg+xml;base64,PHN2ZyB2a...CAgPC9nPgogIDwvZz4KPC9zdmc+Cg==",
"name": "Amazon EC2"
},
"statements": [
{
"action": "ec2:DescribeNetworkInterfaces",
"effect": "Allow",
"resource": "*",
"service": "ec2",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "ec2:CreateNetworkInterface",
"effect": "Allow",
"resource": "*",
"service": "ec2",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "ec2:DeleteNetworkInterface",
"effect": "Allow",
"resource": "*",
"service": "ec2",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "ec2:DescribeInstances",
"effect": "Allow",
"resource": "*",
"service": "ec2",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "ec2:AttachNetworkInterface",
"effect": "Allow",
"resource": "*",
"service": "ec2",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "ec2:DescribeSecurityGroups",
"effect": "Allow",
"resource": "*",
"service": "ec2",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "ec2:DescribeSubnets",
"effect": "Allow",
"resource": "*",
"service": "ec2",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "ec2:DescribeVpcs",
"effect": "Allow",
"resource": "*",
"service": "ec2",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
}
]
},
"logs": {
"service": {
"icon": "data:image/svg+xml;base64,PHN2ZyB2aWV3Qm94PSIwIDAg...z4KICA8L2c+Cjwvc3ZnPgo=",
"name": "Amazon CloudWatch Logs"
},
"statements": [
{
"action": "logs:CreateLogGroup",
"effect": "Allow",
"resource": "*",
"service": "logs",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "logs:CreateLogStream",
"effect": "Allow",
"resource": "*",
"service": "logs",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "logs:DescribeLogGroups",
"effect": "Allow",
"resource": "*",
"service": "logs",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "logs:DescribeLogStreams",
"effect": "Allow",
"resource": "*",
"service": "logs",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "logs:PutLogEvents",
"effect": "Allow",
"resource": "*",
"service": "logs",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "logs:GetLogEvents",
"effect": "Allow",
"resource": "*",
"service": "logs",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
},
{
"action": "logs:FilterLogEvents",
"effect": "Allow",
"resource": "*",
"service": "logs",
"source": {
"index": "0",
"policyName": "aws_iam_policy_lambda_vault_lab",
"policyType": "managed"
}
}
]
}
},
"roleName": "lambda_role_vault_lab",
"trustedEntities": [
"lambda.amazonaws.com"
]
}
I don't include the python code has the lambda crashs before starting executing it.
For info, I tried a few changes in the policy without any effects.
Has someone an idea where I did go wrong?
Thanks, :)
David