Cognito Client Randomly Timing out while deployed to AWS lambda

[Nic-vwalt]

My go web server is being run on a single AWS lambda invocation. Currently its limited to 1 invocation at a time.

75% of the time when a new invocation is started up there are no issues, but the rest of the time my cognito client randomly times out.

SOLVED!
UPDATE: Seems the issue was with my VPC's subnets - It was starting up in either a public or private subnet and didn't have any internet access when started inside the public one.

func (a *AWSConfig) NewCognitoClient(ctx context.Context) (*cognitoidentityprovider.Client, error) {
    // Configure HTTP client with custom timeout
    httpClient := &http.Client{
        Timeout: 5 * time.Second,
        Transport: &http.Transport{
            MaxIdleConns:    10, // Adjust according to usage
            IdleConnTimeout: 20 * time.Second,
        },
    }

    // Use the standard retryer with custom configurations
    customRetryer := retry.NewStandard(func(o *retry.StandardOptions) {
        o.MaxAttempts = 3 // Adjust the number of retry attempts as needed
        o.MaxBackoff = 3 * time.Second // Adjust the maximum backoff as needed
    })

    // Load AWS configuration
    cfg, err := config.LoadDefaultConfig(ctx,
        config.WithRegion(a.Region),
        config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(a.AccessKey, a.SecretKey, "")),
        config.WithHTTPClient(httpClient),
        config.WithRetryer(func() aws.Retryer { return customRetryer }),
    )
    if err != nil {
        log.Println("Error creating Cognito Client: ", err)
        return nil, err
    }

    if a.BUILD_MODE == "debug" {
        cfg.Region = a.SecretRegion
    }

    // Create the Cognito Identity Provider client
    return cognitoidentityprovider.NewFromConfig(cfg), nil
}

I've tried playing with a longer timeout period and only 1 try, but a retry has never been of any use. Once a Cognito Client times out on the lambda invocation the retries are useless.

[RanVaknin]

Hi @Nic-vwalt,

A couple of thoughts here.
The code you shared does not show any use of the Cognito client, instead all we see is the creating of a credential provider. Ideally we would want to see how youre using this in your operation.

Moreover, the fact that you mentioned you are using Lambda, makes me wonder if you Lambda is timing out before you code is finished running, you'll see timeout. By default Lambda timeout is set to 3 seconds. Perhaps you need to configure your Lambda with a longer timeout value?

Thanks,
Ran~

[Nic-vwalt]

Issue was with the Lambda's VPC - I've updated my post to show I solved the issue

[madelinecameron]

@Nic-vwalt

UPDATE: Seems the issue was with my VPC's subnets - It was starting up in either a public or private subnet and didn't have any internet access when started inside the public one.

First off, apologies to maintainer for light-necro.

Thank you for actually leaving the solution! I have been looking around passively on the internet for this issue for a few months whenever it was biting us hard. I can confirm this works in nodejs as well, since this is an infrastructure issue, this seems to have also solved my problem of Cognito timing out even when it is set to the maximum 30s.

This likely expands to all AWS services except the issue with Cognito is that it doesn't have a VPC Endpoint so you can't get around this issue.