Examkin

Question

Difficulty: HardServerless Development with AWS Lambda

A developer is implementing an AWS Lambda function that queries an Amazon RDS for PostgreSQL DB instance. The Lambda function is configured to connect to the database using IAM database authentication. To minimize connection overhead and query latency, the developer initializes a database connection pool in the global scope (outside the Lambda handler function) and generates the IAM database authentication token once during this initialization. During initial testing, the Lambda function successfully connects to the RDS instance and retrieves data. However, when the application is left idle and then invoked again after 30 minutes, subsequent invocations fail with database authentication errors. Which action should the developer take to resolve this issue while maintaining optimal database connection management?

  1. A
    Move the database connection pool initialization and connection establishment entirely inside the Lambda handler function so that a new pool is created on every invocation.
  2. B
    Configure the Lambda function's execution timeout to 15 minutes to force AWS Lambda to automatically recycle the execution context and refresh the token.
  3. Keep the connection pool in the global scope, but configure the pool to dynamically generate a new IAM database authentication token whenever a new connection is established.Answer
  4. D
    Hardcode a static database credential token in the Lambda function's environment variables and decrypt it using AWS KMS helper tools on each invocation.

Answer

Keep the connection pool in the global scope, but configure the pool to dynamically generate a new IAM database authentication token whenever a new connection is established.
The correct approach is to maintain the connection pool in the global scope (enabling connection reuse across warm invocations) but configure the pool to dynamically request a new IAM database authentication token whenever it creates a new database connection. Since IAM database authentication tokens are only valid for 15 minutes, any attempts by the pool to establish new connections (such as after connection idle timeouts or pool scaling) using the initial global token will fail. By dynamically generating the token during connection creation, the pool always uses a valid credential.

Step-by-Step Solution

1
Analyze the lifecycle of IAM database authentication tokens and Lambda execution contexts.
Note that IAM database authentication tokens expire after 15 minutes, while Lambda execution contexts can persist and be reused for longer periods.
To identify why the database connection pool fails to authenticate when trying to open new connections after 15 minutes have passed.
2
Evaluate the placement of the connection pool and token generation code.
Understand that keeping the pool in the global scope is necessary for connection reuse, but the token must not be static or generated only once at startup.
To find a solution that balances database connection pooling efficiency with dynamic token refreshes.
3
Configure the connection pool to refresh authentication tokens.
Provide a connection creation function or callback to the global connection pool that dynamically calls the RDS AWS SDK client to generate a new IAM authentication token whenever a new physical connection is opened.
This guarantees that new connection handshakes succeed with valid tokens, while existing established connections are reused without performance penalty.

Key Concept

AWS Lambda execution context reuse and RDS IAM database authentication token lifecycle
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic