Examkin

Question

Difficulty: HardAWS CodePipeline

A company is using AWS CodePipeline to automate their deployment process. The pipeline includes a deploy stage that triggers a custom AWS Lambda action to run database migrations against an Amazon RDS MySQL DB instance located in a private subnet. The migration script requires database credentials that must be rotated automatically every 14 days, as well as a non-sensitive database endpoint port number. During execution, the custom Lambda action fails. Which configuration should the developer implement to allow the Lambda function to securely run the migrations while optimizing for operational overhead, cost, and security?

  1. A
    Deploy the Lambda function in a public VPC subnet to ensure it can directly access the public endpoints of AWS Secrets Manager and AWS Systems Manager Parameter Store. Attach a permissions policy to the Lambda execution role allowing secretsmanager:GetSecretValue and ssm:GetParameter, and ensure the trust policy allows the lambda.amazonaws.com principal.
  2. B
    Deploy the Lambda function within the private VPC subnets with a route to a NAT Gateway. Store the database credentials as a SecureString parameter in AWS Systems Manager Parameter Store, and store the database port in AWS Secrets Manager. Configure the Lambda execution role's permissions policy to allow access to both resources, and ensure the trust policy allows the lambda.amazonaws.com principal.
  3. Deploy the Lambda function within the private VPC subnets with a route to a NAT Gateway. Retrieve the database credentials from AWS Secrets Manager and the database port from AWS Systems Manager Parameter Store. Attach a permissions policy to the Lambda execution role allowing secretsmanager:GetSecretValue and ssm:GetParameter, and ensure the role's trust policy allows the lambda.amazonaws.com service principal to assume the role.Answer
  4. D
    Deploy the Lambda function within the private VPC subnets with a route to a NAT Gateway. Retrieve the database credentials from AWS Secrets Manager and the database port from AWS Systems Manager Parameter Store. Update the Lambda execution role's trust policy to permit the secretsmanager:GetSecretValue and ssm:GetParameter actions for the CodePipeline service principal.

Answer

Deploy the Lambda function within the private VPC subnets with a route to a NAT Gateway, retrieving the credentials from AWS Secrets Manager and the port from AWS Systems Manager Parameter Store, while attaching the appropriate permissions policy and a trust policy allowing lambda.amazonaws.com to assume the role.
The correct configuration deploys the Lambda function in private VPC subnets alongside a NAT Gateway to permit egress access to both the RDS database and AWS public service endpoints. By retrieving the database credentials from AWS Secrets Manager, the developer secures the credentials and can leverage automatic secret rotation. Using Systems Manager Parameter Store for the database port optimizes cost for non-sensitive configurations. Finally, creating a permissions policy for the AWS actions and maintaining a trust policy that allows the Lambda service principal to assume the role complies with the AWS IAM model.

Step-by-Step Solution

1
Determine the network topology for the database migration Lambda function.
The Lambda function must be placed in private VPC subnets with a route to a NAT Gateway to access the private RDS DB instance and reach public AWS endpoints for Secrets Manager and Parameter Store.
Since the RDS MySQL instance is in a private subnet, the Lambda function needs to be in the same VPC to communicate with it, and it needs a NAT Gateway to call AWS API endpoints.
2
Select the correct secrets and parameter storage services based on requirements.
Store database credentials in AWS Secrets Manager and the database port in Systems Manager Parameter Store.
AWS Secrets Manager is required because it natively supports automatic rotation every 14 days. Systems Manager Parameter Store is used for the non-sensitive port number to minimize costs.
3
Configure the Lambda execution role policies.
Attach a permissions policy allowing secretsmanager:GetSecretValue and ssm:GetParameter. Ensure the trust policy allows lambda.amazonaws.com to assume the role.
The permissions policy governs what resources the role can access, while the trust policy specifies that the Lambda service itself is permitted to assume the role during execution.

Key Concept

Integration of AWS CodePipeline custom actions with VPC network configurations, AWS Secrets Manager, Systems Manager Parameter Store, and IAM role trust/permissions separation.
Estimated Time:2m 0s
Rate this question

Topics

AWS CodePipeline

More questions from this topic