--- title: Day 13/30 AWS System Design Patterns | daily.dev description: A scenario-based AWS system design question explores whether a Lambda function attached to a VPC can be replaced with VPC endpoints to eliminate cold starts.... canonical: https://daily.dev/posts/day-13-30-aws-system-design-patterns-vkvpjzmjq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Day 13/30 AWS System Design Patterns | daily.dev og:description: A scenario-based AWS system design question explores whether a Lambda function attached to a VPC can be replaced with VPC endpoints to eliminate cold starts.... og:url: https://daily.dev/posts/day-13-30-aws-system-design-patterns-vkvpjzmjq og:image: https://api.daily.dev/og/posts/VKVpjzmJq.png og:image:alt: Day 13/30 AWS System Design Patterns og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Day 13/30 AWS System Design Patterns **[Joud Awad](https://daily.dev/sources/iac4jsbu0lv8wbsc85fsh)** · [@joudawad](https://daily.dev/joudawad) · 3 min read · 89 upvotes · 17 comments ## Summary A scenario-based AWS system design question explores whether a Lambda function attached to a VPC can be replaced with VPC endpoints to eliminate cold starts. The setup involves Lambda accessing Aurora PostgreSQL, ElastiCache Redis, and an internal ECS API — all on private IPs within a customer VPC. After a Lambda Layers update causes P99 latency spikes on cold starts, a second engineer suggests removing the VPC attachment. The correct answer is C: VPC endpoints only reach AWS-managed services (S3, SQS, DynamoDB), not customer-owned resources like Aurora clusters, Redis instances, or internal ECS APIs — so VPC attachment remains necessary. ## Content A team builds a Lambda function *(serverless compute, can be attached to a VPC to get private IP addresses in customer subnets)* to deploy alongside an existing ECS-based platform. The function needs to access an Aurora PostgreSQL database *(managed relational DB, lives at a private IP inside the customer VPC — no public endpoint)*, an ElastiCache Redis cluster *(managed in-memory cache, private IP only — no public endpoint)*, and an internal API running on ECS *(container orchestration service, internal services accessible only via private IPs in the VPC)* — all in a private VPC with no public endpoints. The team attaches the Lambda to the VPC. Everything works in testing. Six months later, the Lambda is processing 2,400 invocations per day at 350 ms average duration. The team deploys a Lambda Layers update to add a new SDK. Post-deployment, P99 latency spikes to 6.8 seconds on the first 40 invocations, then returns to normal. A second engineer insists the VPC attachment is unnecessary because "Lambda can reach VPC resources through VPC endpoints now." They propose removing it to eliminate cold starts. Is the engineer correct? A) Yes — Lambda can reach private VPC resources through AWS PrivateLink *(interface endpoints for AWS-managed services like S3, SQS, Secrets Manager — not for arbitrary customer VPC resources)* without being attached to the VPC; but PrivateLink endpoints expose AWS-managed services, not customer-owned Aurora clusters, Redis instances, or ECS internal APIs B) No — Lambda must be attached to the same VPC as all resources it accesses; VPC endpoints only work for AWS-managed services like S3 and DynamoDB, not for anything running inside a customer VPC — this is directionally correct for this scenario but overstates the limitation; VPC endpoints do reach many AWS-managed services from outside a VPC C) No — VPC endpoints *(let Lambda reach AWS-managed services like S3, SQS, DynamoDB privately without VPC attachment)* let Lambda reach AWS-managed services from outside a VPC; but Aurora, ElastiCache, and the ECS internal API are customer VPC resources accessible only via private IP — Lambda must be inside the same VPC to reach them D) Yes — Lambda@Edge *(Lambda deployed at CloudFront edge PoPs — no VPC attachment support, not a general-purpose deployment model)* can route to VPC resources through CloudFront without a VPC attachment; but Lambda@Edge does not support VPC attachment and is not a replacement for a standard VPC-attached Lambda function Answer in the comments. #Networking #AWS #VPC #Security #SystemDesign ## Community discussion Top comments from developers on daily.dev. **@agustinbarrientos** · 2 upvotes > PrivateLink needs a cape before it can reach arbitrary private IPs **@trevorsuna** · 1 upvotes > C is the key distinction: endpoints give private access to supported services, but they do not magically place Lambda on the network with Aurora, Redis, and an internal ECS API. The cold-start spike is worth measuring after deployments, but removing required connectivity is not the fix. **@kentlim** · 1 upvotes > I might be wrong here, but I thought VPC endpoint allows resources **inside** a VPC to reach public endpoint of AWS services without traversing the public internet? So for this case a public Lambda cannot use it anyway, since it is outside the customer VPC. **@joudawad** · 1 upvotes > The answer is C. > > There are two different concepts in play, and confusing them is the source of the engineer's mistake. > > VPC endpoints _(let Lambda reach AWS-managed services like S3, SQS, DynamoDB without VPC attachment)_ — specifically PrivateLink interface endpoints and Gateway endpoints — let resources outside a VPC reach AWS-managed services through the AWS private network without traversing the public internet. A Lambda function outside a VPC can use these endpoints to reach S3 _(object storage)_, DynamoDB _(managed NoSQL database)_, SQS _(message queue)_, Secrets Manager _(credentials... **@eidler** · 1 upvotes > Another lesson for life! You made my day! Thank you so much! --- Tags: [#aws](https://daily.dev/tags/aws), [#career](https://daily.dev/tags/career), [#aws-lambda](https://daily.dev/tags/aws-lambda) [View this post on daily.dev](https://daily.dev/posts/day-13-30-aws-system-design-patterns-vkvpjzmjq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/day-13-30-aws-system-design-patterns-vkvpjzmjq","headline":"Day 13/30 AWS System Design Patterns","text":"A scenario-based AWS system design question explores whether a Lambda function attached to a VPC can be replaced with VPC endpoints to eliminate cold starts. The setup involves Lambda accessing Aurora PostgreSQL, ElastiCache Redis, and an internal ECS API — all on private IPs within a customer VPC. After a Lambda Layers update causes P99 latency spikes on cold starts, a second engineer suggests removing the VPC attachment. The correct answer is C: VPC endpoints only reach AWS-managed services (S3, SQS, DynamoDB), not customer-owned resources like Aurora clusters, Redis instances, or internal ECS APIs — so VPC attachment remains necessary.","url":"https://daily.dev/posts/day-13-30-aws-system-design-patterns-vkvpjzmjq","datePublished":"2026-08-02T18:47:31.352Z","dateModified":"2026-09-13T21:30:41.548Z","author":{"@type":"Person","name":"Joud Awad","url":"https://daily.dev/joudawad","image":"https://media.daily.dev/image/upload/s--dOB9RaXY--/f_auto/v1773320801/avatars/avatar_iaC4JsBU0lV8wBsc85fSh?_a=BAMAMiiu0","description":"Principal Solution Architecture ","worksFor":{"@type":"Organization","name":"Metalab","logo":"https://www.google.com/s2/favicons?domain=metalab.com&sz=128"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":84960}},"image":"https://media.daily.dev/image/upload/s--_iaVX9ut--/f_auto/v1785696452/posts/VKVpjzmJq?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":89},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":17}],"comment":[{"@type":"Comment","text":"PrivateLink needs a cape before it can reach arbitrary private IPs","datePublished":"2026-08-09T17:21:57.647Z","url":"https://daily.dev/posts/VKVpjzmJq#c-w5fxhUWzD","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"C is the key distinction: endpoints give private access to supported services, but they do not magically place Lambda on the network with Aurora, Redis, and an internal ECS API. The cold-start spike is worth measuring after deployments, but removing required connectivity is not the fix.","datePublished":"2026-08-03T02:42:47.429Z","url":"https://daily.dev/posts/VKVpjzmJq#c-zWi5oNRRf","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"I might be wrong here, but I thought VPC endpoint allows resources inside a VPC to reach public endpoint of AWS services without traversing the public internet? So for this case a public Lambda cannot use it anyway, since it is outside the customer VPC.","datePublished":"2026-08-02T23:04:57.334Z","url":"https://daily.dev/posts/VKVpjzmJq#c-brCZdqWBn","author":{"@type":"Person","name":"Kent Lim","url":"https://daily.dev/kentlim","image":"https://avatars.githubusercontent.com/u/106628390?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"The answer is C.\nThere are two different concepts in play, and confusing them is the source of the engineer’s mistake.\nVPC endpoints (let Lambda reach AWS-managed services like S3, SQS, DynamoDB without VPC attachment) — specifically PrivateLink interface endpoints and Gateway endpoints — let resources outside a VPC reach AWS-managed services through the AWS private network without traversing the public internet. A Lambda function outside a VPC can use these endpoints to reach S3 (object storage), DynamoDB (managed NoSQL database), SQS (message queue), Secrets Manager (credentials store), and others privately.\nBut Aurora PostgreSQL (managed relational DB, private IP only), ElastiCache Redis (managed cache, private IP only), and an ECS (container orchestration) internal API are not AWS-managed services with public or PrivateLink endpoints — they are customer resources running inside the VPC, accessible only via their private IP addresses. There is no PrivateLink service for your own Aurora cluster. The only way Lambda reaches these resources is by being attached to the same VPC so its execution environments get private IP addresses in the VPC’s subnets.\nThe VPC attachment is necessary. The P99 spike post-deployment is a Layer update cold start — new execution environments initializing with the updated Layer package, not a VPC-related issue. The fix for the cold start spike is Provisioned Concurrency (pre-initializes environments before traffic hits them) on the new function version after deployment.","datePublished":"2026-08-02T18:48:40.537Z","url":"https://daily.dev/posts/VKVpjzmJq#c-x7a7w2rel","author":{"@type":"Person","name":"Joud Awad","url":"https://daily.dev/joudawad","image":"https://media.daily.dev/image/upload/s--dOB9RaXY--/f_auto/v1773320801/avatars/avatar_iaC4JsBU0lV8wBsc85fSh?_a=BAMAMiiu0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"Another lesson for life! You made my day! Thank you so much!","datePublished":"2026-08-18T23:14:27.838Z","url":"https://daily.dev/posts/VKVpjzmJq#c-AVRwJ7oXv","author":{"@type":"Person","name":"Andre Eidler","url":"https://daily.dev/eidler","image":"https://media.daily.dev/image/upload/s--LYO8LQON--/f_auto/v1736560804/avatars/avatar_HGPMk4QdK9uYOFIzJIPsP"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/iac4jsbu0lv8wbsc85fsh","name":"Joud Awad"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Joud Awad","item":"https://daily.dev/sources/iac4jsbu0lv8wbsc85fsh"},{"@type":"ListItem","position":3,"name":"Day 13/30 AWS System Design Patterns"}]} ```