Solution 1:

You either need to create a DyanmoDB VPC Endpoint in the VPC, or add a NAT Gateway to the VPC, and only deploy the Lambda function in subnets that have a route to the NAT Gateway.

Solution 2:

Depending on the VPC configuration subnet/Security Group of your lambda,

If your lambda is in a private subnet :

  • If you want a secure internal way, you can pass with VPC endpoint
  • Else if you want to pass with internet, you must have a NAT Gateway.

Check also the security groups/NACLS....