无法从 VPC 私有子网内的 Lambda 发布到 SNS 主题

问：

我有一个 lambda 函数，它需要访问在我的 VPC 的私有子网上运行的 EC2。因此，我将 lambda 与 VPC 的私有子网相关联。我的 lambda 还需要发布到 SNS 主题。我什至为 SNS 访问配置了 SNS VPC 接口终端节点。但是我无法从这个 lambda 发布到 SNS。我做错了什么？这是我的配置。

resource "aws_vpc_endpoint" "sns" {
  vpc_id              = VPC_ID
  service_name        = "com.amazonaws.ca-central-1.sns"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids = [
    PRIVATE_SUBNET_ID
  ]
  security_group_ids = [
    SECURITY_GROUP_FOR_PRIVATE_EC2_ID
  ]
}

resource "aws_eip" "nat_eip" {
  domain = "vpc"
  tags = {
    Name = "TAG"
  }

  depends_on = [aws_internet_gateway.db_proxy]
}

resource "aws_nat_gateway" "db_proxy" {
  allocation_id = aws_eip.nat_eip.id
  subnet_id     = PUBLIC_SUBNET_ID

  tags = {
    Name = "TAG"
  }

  depends_on = [aws_internet_gateway.db_proxy]
}

# Route Table associated with Private Subnet
resource "aws_route_table" "db_proxy_private" {
  vpc_id = VPC_ID

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.db_proxy.id
  }

  tags = {
    Name = "TAG"
  }
}

# Security group associated with Private EC2.
resource "aws_security_group" "db_proxy_sg_private" {
  name        = NAME
  description = "Managed by Terraform"
  vpc_id      = VPC_ID

  # To Allow SSH Transport
  ingress {
    from_port   = 22
    protocol    = "tcp"
    to_port     = 22
    cidr_blocks = ["10.0.1.0/24"] // Public Subnet CIDR
    description = "Whitelisted SSH IPs"
  }

  # To Allow Port 80 Transport
  ingress {
    from_port   = 80
    protocol    = "tcp"
    to_port     = 80
    cidr_blocks = ["10.0.1.0/24"] // Public Subnet CIDR
    description = "Outgoing HTTP transport"
  }

  # Open port 8000 for external access
  ingress {
    from_port   = 8000
    protocol    = "tcp"
    to_port     = 8000
    cidr_blocks = ["10.0.1.0/24"] // Public Subnet CIDR
    description = "EC2 HTTP port"
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  lifecycle {
    create_before_destroy = true
  }
}

假设 Lambda 已成功与私有子网和私有安全组关联。Lambda 配置未在此处附加。

当 lambda 与私有子网关联时，我的 SNS 调用超时。解离后，它会按预期工作。我假设配置 SNS VPC 接口终端节点有问题。