Examkin

Question

Difficulty: HardVPC Security for Developers

A developer is deploying a backend microservice on an AWS Lambda function that is configured to run inside the private subnets of a custom VPC. The function must retrieve database credentials from AWS Secrets Manager and query an Amazon DynamoDB table. Due to strict compliance guidelines, the VPC has no Internet Gateway or NAT Gateway attached, and all traffic must remain within the AWS network.

Which two configuration steps should the developer perform to establish private connectivity to these services while maintaining the principle of least privilege? (Select TWO.)

  1. Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route tables of the private subnets.Answer
  2. Create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, and configure its security group to allow inbound HTTPS traffic from the security group associated with the Lambda function.Answer
  3. C
    Configure the Lambda function's security group to allow outbound traffic to 0.0.0.0/0, and rely on the default VPC route table to route traffic to the public endpoints of Secrets Manager and DynamoDB.
  4. D
    Create a Gateway VPC Endpoint for AWS Secrets Manager, and store the credentials in Systems Manager Parameter Store as Standard String parameters.
  5. E
    Modify the trust policy of the Lambda function's execution role to allow secretsmanager.amazonaws.com and dynamodb.amazonaws.com to assume the role, enabling direct network access.

Answer

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route tables of the private subnets, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets with its security group configured to allow inbound HTTPS traffic from the security group associated with the Lambda function.
To connect to AWS services privately from a VPC without internet access, developers must use VPC endpoints. Amazon DynamoDB supports Gateway VPC Endpoints, which route traffic directly to the service using route table entries associated with the private subnets. AWS Secrets Manager requires an Interface VPC Endpoint, which deploys Elastic Network Interfaces (ENIs) into the subnets. To secure access to the Secrets Manager Interface Endpoint under the principle of least privilege, its security group must allow inbound HTTPS (port 443) traffic from the security group of the Lambda function.

Step-by-Step Solution

1
Determine the correct VPC endpoint type for Amazon DynamoDB.
Identify that DynamoDB supports Gateway VPC Endpoints.
Gateway endpoints provide private routing to DynamoDB via subnet route tables without incurring hourly charges or requiring security group modifications.
2
Determine the correct VPC endpoint type for AWS Secrets Manager.
Identify that Secrets Manager requires an Interface VPC Endpoint (AWS PrivateLink).
Secrets Manager does not support Gateway endpoints; it requires an Interface endpoint, which places an Elastic Network Interface (ENI) with a private IP in the subnets.
3
Configure the security group for the Secrets Manager Interface VPC Endpoint.
Allow inbound HTTPS (TCP port 443) traffic originating from the specific security group assigned to the Lambda function.
This implements the principle of least privilege, ensuring only the authorized Lambda function can reach the Secrets Manager interface.

Key Concept

VPC Endpoint Routing and Security Group Configuration for Private AWS Service Access
Estimated Time:2m 0s
Rate this question

Topics

VPC Security for Developers

More questions from this topic