Failed to forward Kinesis records to destination stream

[awslabs]

Failed to forward Kinesis records to destination stream

[brachipa]

No need NAT, you can do it also with VPC endpoint:
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html
And that is how to do it to Kinesis:
https://docs.aws.amazon.com/streams/latest/dev/vpc.html

Works for me :) and match cheaper.

If you will read the NAT pricing documnentation they are also recommending this:
https://aws.amazon.com/vpc/pricing/
read the note at the end:

Note: To avoid the NAT Gateway Data Processing charge in this example, you could setup a Gateway Type VPC endpoint and route the traffic to/from S3 through the VPC endpoint instead of going through the NAT Gateway. There is no data processing or hourly charges for using Gateway Type VPC endpoints. For details on how to use VPC endpoints, please visit VPC Endpoints Documentation.

Is your Lambda running in a VPC by chance?

[AEKurt]

Not by chance. Intentionally we have put our lambda in vpc. What could be problem ?

I'm not sure how the Lambda/Kinesis integration for reading works, but for publishing, it seems like the request is getting dropped by a firewall or network rule somewhere. Kinesis is not directly accessible from within a VPC (i..e it doesn't support VPC endpoints), so a request from your Lambda needs get out to the Internet to get to Kinesis.

From a public subnet, you'd need to confirm that port 443 is allowed from:

Lambda -> Internet Gateway -> Kinesis

From a private subnet, you'd need to confirm that port 443 is allowed from:

Lambda -> NAT -> Internet Gateway -> Kinesis

Double-check 443 outbound on your Lambda security group, your NAT rules (if they exist), your ACLs, etc. You could try turn on VPC flow logs to help diagnose the problem.

I'll double-check when I get a chance, but it seems unlikely it's a code problem unless we're configured to talk to a non-existent endpoint or something weird like that.

[AEKurt]

Thank you for your help. We have directly give internet gateway to our subnet, however we did not use NAT. We have solved problem with using NAT.

Lambda -> NAT -> Internet Gateway -> Kinesis