Your Lambda Times Out Talking to RDS — Here's Why

Your Lambda works perfectly from your laptop but times out the moment it tries to reach an RDS database in AWS. The code is fine — the problem is where Lambda lives on the network and how it manages connections. Here are the two causes and their fixes.

Cause 1: The Lambda Is Not in the Right VPC

A private RDS instance lives inside a VPC and is not reachable from the public internet. If your Lambda is not attached to that VPC (and the right subnets and security groups), its connection attempt goes nowhere and eventually times out.

Attach the Lambda to the VPC and allow it in the database's security group:

Lambda → Configuration → VPC → select the RDS VPC + private subnets
RDS security group → inbound rule → allow Lambda's security group on port 5432

The RDS security group must explicitly allow the Lambda's security group as a source. This is the single most common cause.

Cause 2: Connection Exhaustion

Lambda scales by running many concurrent execution environments. If each one opens its own database connection, a spike can blow past RDS's connection limit, and new connections start timing out:

// Anti-pattern: a fresh connection per invocation, never closed
export const handler = async () => {
  const conn = await mysql.createConnection(config);  // 1000 concurrent = 1000 conns
  return conn.query("SELECT 1");
};

Put RDS Proxy between Lambda and the database. It pools and reuses connections so a thousand concurrent Lambdas share a small, stable set:

Create RDS Proxy → point Lambda at the proxy endpoint instead of RDS directly

Don't Forget the NAT

Once a Lambda is in a VPC, it loses default internet access. If it also needs to reach the AWS APIs or the internet, add a NAT gateway or VPC endpoints — otherwise those other calls start timing out instead.

Summary

An RDS timeout from Lambda is a networking or pooling problem, not a code bug. Put the Lambda in the database's VPC and open the security group to it, and front RDS with RDS Proxy so connection storms don't exhaust the limit. Remember that VPC-attached Lambdas need a NAT or endpoints for anything else they call.