Examkin

Question

Difficulty: MediumServerless Development with AWS Lambda

A developer is configuring an AWS Lambda function that processes user session data. The function needs to connect to an Amazon ElastiCache for Redis cluster running in private subnets within a VPC. Additionally, the function must retrieve an API key stored in AWS Secrets Manager to authenticate calls to an external third-party service. The developer deploys the Lambda function inside the same private subnets of the VPC to ensure connectivity to the Redis cluster. However, during testing, the function fails to connect to AWS Secrets Manager and timeouts when attempting to invoke the external third-party API. Which two actions should the developer take to resolve these connectivity issues? (Select two.)

  1. Configure a NAT Gateway in a public subnet of the VPC, and add a route in the private subnets' route table directing 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway.Answer
  2. Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnets, and configure the security groups to allow traffic between the Lambda function and the endpoint.Answer
  3. C
    Create a Gateway VPC Endpoint for AWS Secrets Manager, and associate it with the route tables of the private subnets where the Lambda function is deployed.
  4. D
    Move the Lambda function to the public subnets of the VPC and enable the public IP address setting in the function's VPC configuration.
  5. E
    Configure AWS Systems Manager Parameter Store using local environment variables to store the secret keys to avoid external network calls.

Answer

To resolve the connectivity issues, the developer must configure a NAT Gateway in a public subnet of the VPC and route internet-bound traffic from the private subnets to it, allowing the Lambda function to reach the external third-party API. Additionally, the developer should create an Interface VPC Endpoint for AWS Secrets Manager in the VPC so the Lambda function can privately access Secrets Manager without traversing the public internet.
The correct solution involves two steps: first, configuring a NAT Gateway in a public subnet of the VPC and adding a default route (0.0.0.0/00.0.0.0/0) in the private subnet route table to allow the Lambda function to reach the external API. Second, creating an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager inside the VPC allows private communication with the Secrets Manager service without needing to go over the public internet, satisfying security and architectural requirements.

Step-by-Step Solution

1
Analyze the network requirements of the Lambda function.
The Lambda function needs access to a private resource (ElastiCache), an AWS service (Secrets Manager), and an external public endpoint (third-party API).
Placing the Lambda function in a private subnet allows it to access ElastiCache, but blocks outbound internet access by default.
2
Identify the solution for external internet access.
Create a NAT Gateway in a public subnet and update the private subnet route tables to direct 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway.
This allows the Lambda function to securely initiate outbound connections to the third-party API.
3
Identify the solution for secure AWS service access from a private subnet.
Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager.
This enables private routing directly to Secrets Manager over the AWS network, which is more secure and cost-effective than routing AWS API traffic through a NAT Gateway.

Key Concept

Configuring VPC networking for AWS Lambda functions requiring both private VPC resource access and external internet/AWS service connectivity.
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic