By default Lambda functions can only communicate with resources on the public internet, so the EC2 instance's public IP, the AWS APIs, etc. From there you need to make sure the security group (SG) assigned to the EC2 instance can receive (Inbound) traffic from the SG assigned to the Lambda function.