Examkin

Question

Difficulty: HardVPC Security for Developers

A developer is implementing a microservice using an AWS Lambda function that retrieves database credentials from AWS Secrets Manager and then connects to an Amazon RDS PostgreSQL database. The RDS database is hosted in private subnets within a VPC. To secure the database connection, the developer configures the Lambda function to run inside the same VPC and private subnets. However, during testing, the Lambda function execution times out during the SDK client initialization and call to Secrets Manager.

Which configuration change should the developer implement to resolve this issue while maintaining the most secure architecture?

  1. Configure an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager within the private subnets, and configure the security groups to allow HTTPS traffic from the Lambda function to the endpoint.Answer
  2. B
    Modify the Lambda function configuration to associate it with public subnets and enable public IP address assignment to allow it to communicate directly with the public endpoint of AWS Secrets Manager.
  3. C
    Update the trust policy of the Lambda function's IAM execution role to trust the AWS Secrets Manager service principal (secretsmanager.amazonaws.com), allowing it to push credentials to the execution environment.
  4. D
    Migrate the database credentials from AWS Secrets Manager to the AWS Systems Manager Parameter Store as a SecureString, since Parameter Store is natively accessible within private subnets without additional routing configurations.

Answer

Configure an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager within the private subnets, and configure the security groups to allow HTTPS traffic from the Lambda function to the endpoint.
The correct configuration is to create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnets. This registers Elastic Network Interfaces (ENIs) with private IP addresses in the VPC subnets that route traffic directly to AWS Secrets Manager over the AWS internal network. By allowing outbound HTTPS (port 443443) from the Lambda function's security group to the VPC endpoint's security group, the Lambda function can resolve the endpoint privately and securely retrieve the database credentials.

Step-by-Step Solution

1
Analyze the network path of the Lambda function running inside the private VPC subnets.
The Lambda function has access to VPC resources (like the RDS database) but lacks direct access to the public internet because there is no NAT Gateway or internet gateway routing in the private route table.
By default, AWS service endpoints like AWS Secrets Manager are public, requiring internet access or a private endpoint to connect from within a VPC.
2
Determine the most secure method to access AWS Secrets Manager without routing traffic over the public internet.
Identify that AWS PrivateLink allows creating Interface VPC Endpoints inside the VPC subnets.
VPC Endpoints provide private, secure access to AWS services by assigning private IP addresses from the VPC subnets directly to the endpoint.
3
Configure the security groups for both the Lambda function and the Interface VPC Endpoint.
The Lambda function's security group must allow outbound HTTPS (port 443443) to the VPC endpoint, and the VPC endpoint's security group must allow inbound HTTPS (port 443443) from the Lambda function.
Security groups are stateful and must explicitly allow the necessary traffic directions to establish the TCP connection.

Key Concept

VPC Endpoints (AWS PrivateLink) enable private connectivity between VPC resources and supported AWS services without internet traversal.
Estimated Time:2m 0s
Rate this question

Topics

VPC Security for Developers

More questions from this topic