When you use Lambda outside VPC, it means a request to DynamoDB will go over the internet which might traverse over multiple ISPs. This leaves room where requests may get lost along the path, this is especially true if the issue is intermittent and error shows timeout exceptions.

It is actually better from a DynamoDB perspective to have your Lambda inside a VPC, this is because the network path becomes predictable, thus more stable. When you have your Lambda inside the VPC, you can make use of DynamoDB's VPC endpoint to access DynamoDB (Lambda -> Lambda ENI - > DDB VPCendpoint -> DDB service). Furthermore, this allows better monitoring, because you will be able to use VPC flow logs to see network traffic and determine if messages are being dropped. Since DNS uses UDP for DNS queries, the packets can get lost along the path (Lambda probably has a retry mechanism for retry DNS queries).

IIRC, that's accurate (that a lambda not in a vpc is hitting ddb over the internet), but I also think I understood that AWS still optimizes the network traffic (internet or not) between two services like that (regardless of region); amazon global backbone yada yada.

[1:10 PM]

const agent = new https.Agent({
  maxSockets: 1000,
  keepAlive: true,
});

AWS.config.update({
  httpOptions: {
    timeout: 10_000,
    connectTimeout: 5000,
    agent,
  },
  maxRetries: 0,
});