My Private Serverless VPC Project

What I Wanted to Build

My goal was to create a secure AWS serverless application running inside a private network. I wanted AWS Lambda functions to communicate with DynamoDB without exposing anything to the public internet.

The Problem I Faced

When I deployed my CloudFormation template, it kept failing. I spent hours reading docs, switching between examples, and wondering whether I needed a NAT Gateway, an Internet Gateway, or both.

“I was going back and forth, researching, tweaking the template, redeploying over and over… nothing seemed to work. The stack failed every time.”

The Breakthrough

After digging deeper, I realised something important:

I didn’t need an Internet Gateway at all.
I only needed a VPC Gateway Endpoint for DynamoDB.

That single change meant Lambda could talk to DynamoDB privately, inside the VPC, without any public route. No NAT costs. No public access. Fully secure.

What the Final Architecture Achieved

Lambda runs inside private subnets
DynamoDB access is private via a Gateway Endpoint
No Internet Gateway required
No NAT Gateway cost
More secure by default

This architecture follows AWS best practices for private serverless networking and costs nothing extra to operate.

Key Lesson

Private doesn’t mean complicated — it means understanding the difference between Gateway Endpoint and Internet Gateway.

“I thought I needed the internet. In the end, the most secure solution required staying private all along.”

View the Full Code on GitHub

The complete CloudFormation template and project files are available on my GitHub repository. You can explore the code, download it, clone it, or use it as a reference for your own private serverless architectures.

🔗 Visit Repository: github.com/Jazblue/PrivateCloud