Question: As per [this document](http://docs.aws.amazon.com/lambda/latest/dg/vpc.html), if I need to access internet resources from my Lambda function with VPC access, I need to set up a NAT gateway. 

So I followed [this guide](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-nat-gateway.html) to set up a NAT gateway. However, at the stage when I need to edit the route tables of my subnet to add an entry with destination: 0.0.0.0/0 and target as my NAT gateway's id, I got an error that 

```
An entry with this destination already exists

```

I checked and noticed that for that existing entry, the target was an internet gateway for my VPC. If I replace that entry with the NAT gateway id, I cannot access any of the EC2 instances in that VPC through SSH from the outside world. How can I achieve a solution where all the EC2 instances in this VPC:

* Are accessible only via SSH and the rest of the traffic is blocked
* Are able to completely access other EC2 instances in the same VPC
* Lambda function having access to this VPC can access outside resources like SQS and Kinesis.

Answer: 
You need two different subnets. It sounds as if you only have one. 

Lambda can only use *private* subnets inside VPC.

Definition of a private subnet: the default route is a NAT instance (which most be on a different, public subnet) or a NAT Gateway, and *no* machines in the subnet have a public IP address. Machines with public IP addresses are allowed on a private subnet, but for the most part, they will not work properly, because this is technically a misconfiguration.

Definition of a public subnet: the default route is the `igw-xxxxxxxx` Internet Gateway object, and machines have public IP addresses assigned. Machines without public IP addresses are allowed on a public subnet, but they will not be able to access the Internet, because this is a misconfiguration.

It sounds like you are trying to change your existing subnet from public to private by changing the default route. As expected, this breaks other things.

See also [Why do we need private subnet in VPC?](https://stackoverflow.com/a/22212017/1695906)
You actually don't need to create Internet and NAT gateways anymore:<https://aws.amazon.com/blogs/security/how-to-connect-to-aws-secrets-manager-service-within-a-virtual-private-cloud/>