Examkin

Question

Difficulty: HardServerless Development with AWS Lambda

An organization's order-fulfillment system uses an AWS Lambda function to process batch payloads and write them to an Amazon Aurora PostgreSQL database located in a private subnet of a VPC. The Lambda function is configured to access the database directly by running within the same private VPC subnets. Database credentials must be retrieved from AWS Secrets Manager on each execution. During load testing, the Lambda function experiences connection timeouts when trying to retrieve secrets from Secrets Manager. Additionally, high concurrency causes the database to reject connections due to reaching its maximum connection limit. Which combination of actions should the developer take to resolve these issues? (Select two.)

  1. Create an Interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC, and associate it with the route tables and subnets used by the Lambda function.Answer
  2. Set up an Amazon RDS Proxy for the Aurora database and configure the Lambda function to connect to the proxy endpoint instead of the database instance.Answer
  3. C
    Move the Lambda function to a public subnet within the VPC, assign a public IP address to the function, and configure a route to route Secrets Manager traffic directly through an Internet Gateway.
  4. D
    Migrate the database credentials from AWS Secrets Manager to Systems Manager Parameter Store, and configure the Lambda function to retrieve them using the default endpoint without a VPC endpoint.
  5. E
    Increase the Lambda function's execution timeout to 15 minutes, and instantiate the database connection pool inside the Lambda handler function on every invocation.

Answer

To resolve the issues, the developer must create an Interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC, and set up an Amazon RDS Proxy for the Aurora database to manage connection pooling.
Creating an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager creates private network interfaces in the subnets, enabling the Lambda function to reach Secrets Manager without leaving the AWS network. Setting up Amazon RDS Proxy pools database connections, preventing concurrent Lambda invocations from exhausting the database instance's connection limits.

Step-by-Step Solution

1
Analyze the connection timeouts to AWS Secrets Manager.
The Lambda function runs inside private subnets of a custom VPC to reach the RDS database. Without a NAT Gateway or VPC endpoints, resources in private subnets cannot access public AWS endpoints like Secrets Manager.
AWS Secrets Manager is a public service. To connect to it privately from a private VPC subnet, an Interface VPC Endpoint must be established.
2
Analyze the database connection limit exhaustion.
AWS Lambda is highly scalable and creates separate execution environments (and database connections) for concurrent requests, which quickly overwhelms traditional database connection limits.
To manage connections effectively, Amazon RDS Proxy should be introduced between the Lambda function and the database to pool and reuse database connections.

Key Concept

VPC endpoints are required for private VPC subnets to access public AWS services without a NAT Gateway, and RDS Proxy manages connection pooling for highly concurrent serverless environments.
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic