Question: As per [this document](http://docs.aws.amazon.com/lambda/latest/dg/vpc.html), if I need to access internet resources from my Lambda function with VPC access, I need to set up a NAT gateway. 

So I followed [this guide](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-nat-gateway.html) to set up a NAT gateway. However, at the stage when I need to edit the route tables of my subnet to add an entry with destination: 0.0.0.0/0 and target as my NAT gateway's id, I got an error that 

```
An entry with this destination already exists

```

I checked and noticed that for that existing entry, the target was an internet gateway for my VPC. If I replace that entry with the NAT gateway id, I cannot access any of the EC2 instances in that VPC through SSH from the outside world. How can I achieve a solution where all the EC2 instances in this VPC:

* Are accessible only via SSH and the rest of the traffic is blocked
* Are able to completely access other EC2 instances in the same VPC
* Lambda function having access to this VPC can access outside resources like SQS and Kinesis.

Answer: 
I found a good detailed tutorial on how to allow your lambda to connect to both VPC ressources and the internet here: <https://gist.github.com/reggi/dc5f2620b7b4f515e68e46255ac042a7>

A quick walk-through:

* setup new subnets for your lambda (with CIDRs not overlapping your existing subnets). You need:
	+ one subnet which will be pointing to an Internet Gateway (IGW) to be used by the NAT (let's call it A)
	+ several pointing to the NAT to be used by your lambda (B, C and D)
* add a NAT gateway: set the subnet to A
* set your lambda VPC subnets to B, C and D
* create 2 routes table:
	+ one that points to your NAT with destination 0.0.0.0/0
	+ one that points to your IGW (should already exists) with destination 0.0.0.0/0
* update the subnet A to use the route table pointing to the IGW
* update the subnets B, C and D to use the route table pointing to the NAT

Hope this helps.
For using your Lambda inside of your VPC and internet access: 

I believe, most of you already have IGW ,that you're working with inside of your VPC and working with internet,so no need create a new one. 

Steps worked for me: 

1. Create a new subnets (recommended 2 or more) under your main VPC. Give it new CIDR with a mask ,you think it'll be count of network interfaces use in your Lambda.(I did X.X.X.X/28 , because for us it's enough)
2. Create NAT Gateway , add to it Elastic IP or create new EIP and add it to your main Subnet under your VPC. (remember it'll work if you already have Internet Gateway)
3. Create Route table and add 0.0.0.0/0 route to Target - Nat Gateway ID (nat-xxxxxxxxxxxxxxxxx)that we've created (step 2)
4. Create new Security Groups (ALL to ALL) for your lambda to work with internet. I believe it's secure to add 0.0.0.0/0 to lambda for internet.
5. Open lambda - choose your VPC, add SG that's you're working with and add new created from the step 4 to work with internet. press Save and Test.