title: Unable to connect to S3 from Lambda/Python/Boto3 when VPC is enabled
body: <p>I have a very simple python function in a lambda which runs fine if I leave VPC disabled.</p>
  <pre class="lang-py prettyprint-override"><code>import json
  import boto3
  import botocore
  
  
  def lambda_handler(event, context):
      s3 = boto3.client('s3', 'us-east-1',
                        config=botocore.config.Config(s3={'addressing_style': 'path'}))
      keys = []
      resp = s3.list_objects_v2(Bucket='[BUCKET_NAME]')
      for obj in resp['Contents']:
          print(obj['Key'])
  
      return {
          'statusCode': 200,
          'body': json.dumps('Hello from Lambda!')
      }
  </code></pre>
  <p>When VPC is enabled the S3 connection continually times out.</p>
  <p>I have gone through many documents, tutorials, forum threads and stack overflow postings, but none of them have helped me.</p>
  <p>My network ACL has 0.0.0.0/0 mappings for ports 80, 443 and 5439 (Redshift).</p>
  <p>My one and only security group has 0.0.0.0/0 mappings for ports 80, 443 and 5439 (Redshift).</p>
  <p>I have only one VPC configured.</p>
  <p>I have 1 NAT Gateway configured.</p>
  <p>I have 1 Internet Gateway configured.</p>
  <p>I have 6 subnets in the VPC:</p>
  <ul>
  <li>Subnets A and B point to the main route table.</li>
  <li>Subnets C and D point to the 'lambda_rt_table_gateway' route table.</li>
  <li>Subnets E and F point to the 'lambda_rt_table_nat' route table.</li>
  </ul>
  <p>I have 2 endpoints in the VPC:</p>
  <ul>
  <li>Endpoint VPCE-A is defined for service 'com.amazonaws.us-east-1.s3' and is mapped to all 3 route tables.</li>
  <li>Endpoint VPCE-B is defined for service 'com.amazonaws.us-east-1.dynamodb' and is mapped to all 3 route tables.</li>
  </ul>
  <p>Finally, I have 3 Route Tables:</p>
  <ul>
  <li><p>The main route table has the following routes:</p>
  </li>
  <li><p>172.31.0.0/1 --&gt; local</p>
  </li>
  <li><p>pl-02cd2c6b (com.amazonaws.us-east-1.dynamodb, 52.94.0.0/22, 52.119.224.0/20) --&gt; vpce-07a6eb423bbbea151</p>
  </li>
  <li><p>pl-63a5400a (com.amazonaws.us-east-1.s3, 54.231.0.0/17, 52.216.0.0/15) --&gt; vpce-0fd10c890bb176b5a</p>
  </li>
  <li><p>0.0.0.0/0 --&gt; igw-04b6aa7c</p>
  </li>
  <li><p>The 'lambda_rt_table_gateway' route table has identical routes as the main.</p>
  </li>
  <li><p>The 'lambda_rt_table_nat' route table has identical routes as well except for the last entry, it is</p>
  </li>
  <li><p>0.0.0.0/0 --&gt; nat-0a5c0a76e3c12c42f</p>
  </li>
  </ul>
  <p>I am pretty sure it is something simple I'm missing.  Please help.</p>
  <p>Thanks a lot.</p>