Error: connect ETIMEDOUT 10.0.2.15:443

What it means

By default a Lambda function runs outside your VPC, on AWS-managed networking with unrestricted outbound internet access. Attaching it to a VPC changes that completely: the function gets an elastic network interface in your subnets, and from that moment its connectivity is exactly what your routing tables, NAT configuration and security groups permit — no more.

ETIMEDOUT is what the resulting dead end looks like. It is not a refusal. A refused connection produces ECONNREFUSED almost instantly, because something answered and declined. A timeout means the packets went out and nothing ever came back, which is the signature of a missing route or a security group silently dropping traffic. That silence is why the error is so uninformative about its own cause, and why the address in the message is the most useful thing in it.

The detail that catches almost everyone is that AWS service endpoints are public addresses. It is natural to assume that a function calling S3, DynamoDB or Secrets Manager stays "inside AWS" and needs no internet route. It does not: without a NAT gateway or a VPC endpoint for that specific service, those calls leave the subnet and go nowhere. And because each interface endpoint covers one service, a function can reach S3 through a gateway endpoint perfectly while timing out on Secrets Manager, which looks like a bug in one particular call rather than a topology gap.

The last thing worth knowing is that you often will not see this error at all. Most SDK and HTTP clients default to connect timeouts far longer than a typical Lambda's own timeout, so the function is killed before the connection gives up — and you get Task timed out after N seconds with no mention of networking anywhere. Setting a short connect timeout is therefore not just good practice but a diagnostic technique: it converts a silent timeout into a logged error naming the address that could not be reached.

What it looks like in CloudWatch

This is the shape the failure arrives in: the lines of one invocation scattered among everything else the log group received at the same moment.

The panel on the right is generated by running the excerpt on the left through the same parser that powers the free web stitcher — it is what the tool actually produces for this input, not an illustration of it.

How to confirm it from the logs

The distinguishing feature is silence, not refusal. ECONNREFUSED means something answered and said no; ETIMEDOUT means nothing answered at all, which is what a dropped packet looks like. The address in the message tells you where it was going — a private 10.x or 172.16-31.x address is inside your VPC, anything else is being routed out of it.

Check the elapsed time before the error against your client's connect timeout. If the two match, the connection attempt ran its full course without a response. And check whether the invocation reached Task timed out first: with a default SDK timeout longer than the function's, Lambda's clock usually expires before the connection does, and you get a timeout with no error at all.

Causes, most likely first

Fixes

yaml# Gateway endpoint — no hourly charge, routes S3 traffic inside the VPC.
S3Endpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    VpcId: !Ref Vpc
    ServiceName: !Sub "com.amazonaws.${AWS::Region}.s3"
    VpcEndpointType: Gateway
    RouteTableIds: [!Ref PrivateRouteTable]

jsimport { NodeHttpHandler } from "@smithy/node-http-handler";

const client = new S3Client({
  requestHandler: new NodeHttpHandler({
    connectionTimeout: 2000,   // fail fast and name the address
    requestTimeout: 5000
  })
});

bash# Confirm what the function is attached to before changing anything.
aws lambda get-function-configuration \
  --function-name orders-fn \
  --query 'VpcConfig'

bashaws ec2 create-network-insights-path \
  --source "$LAMBDA_ENI_ID" \
  --destination "$RDS_ENI_ID" \
  --protocol tcp --destination-port 5432

Also seen as

The same underlying failure, worded differently by a different runtime, SDK version, or logging layer. All of these land here — there is no separate page for each phrasing.

Related errors

Errors that show up alongside this one, or that people mistake for it.

References

• AWS Lambda Developer Guide — Connecting outbound networking to resources in a VPC
• AWS Lambda Developer Guide — Troubleshoot networking issues