Granting a Function in VPC Access to Public Network

Last updated: 2019-08-08 15:53:06

PDF
  • A function deployed in a VPC is isolated from the public network by default. If you want the function to have access to both private network and public network, you can add a NAT gateway to the VPC.

    Note:
    Even after a NAT gateway is configured, functions still cannot access resources on the basic network. If you need to access the basic network, you can contact us by submitting a ticket.

Usage Scenario

  • Access control: This can uniformly converge access requests from the public network to the same address and ensure the uniqueness of the egress address by means of the public network egress in the VPC.
  • Public network permissions for VPC: Functions deployed in the VPC can access the public network.

Creating a NAT Gateway

NAT Gateway is a network cloud service that supports IP address translation and enables high-performance internet access for resources in Tencent Cloud. It can translate the private IP address in a VPC to a public IP address if the private and public networks are isolated from each other, enabling the VPC to access the internet.

Log in to the VPC console > NAT gateway console to create a new NAT gateway. Note:

  • The NAT gateway should be deployed in the same region as the function and VPC.
  • The network to which the NAT gateway belongs should be the VPC where the function is located.

See the figure below:

Creating a Routing Policy

Go to the Routing Table on the left in the VPC console, select the region where the routing table is located and the VPC, and click + Create to create a routing table.

Enabling SCF to Access All Public IP Addresses

If you want SCF to have access to all public networks, you can configure IP:0.0.0.0/0 in the destination in the routing table, and associate the routing table with the created NAT gateway and SCF subnet, as shown in the figure below:

Enabling SCF to Access Certain Public IP Addresses

Add the public IP addresses to be accessed by SCF to the routing table, and associate the routing table with the created NAT gateway and SCF subnet, as shown in the figure below: