Examkin

Question

Difficulty: MediumStream Processing and Event Routing with Amazon Kinesis and EventBridge

A developer is building a dispatch system for a ride-sharing application. The application streams real-time driver location updates to an Amazon Kinesis Data Stream. An AWS Lambda function deployed inside a private subnet of a VPC processes the stream to update an Amazon RDS database. In addition, the developer must route specific high-priority alert events from the stream to an Amazon EventBridge custom event bus. Which two actions should the developer take to ensure optimal stream shard utilization, prevent connectivity issues, and maintain secure integration? (Select TWO.)

  1. Configure the stream producer to use a high-entropy string, such as a hash of the driver ID and a timestamp, as the partition key for each location update.Answer
  2. Deploy a NAT Gateway in the public subnet or configure interface VPC endpoints for Kinesis and EventBridge in the VPC.Answer
  3. C
    Configure the stream producer to use a static partition key like 'LocationUpdate' for all records to simplify stream processing.
  4. D
    Deploy the Lambda function in the private subnet without establishing a NAT Gateway or VPC endpoints, relying on default VPC routing to reach AWS services.
  5. E
    Modify the Lambda execution role trust policy to list the Amazon Kinesis service principal as a trusted entity.

Answer

The developer should configure the stream producer to use a high-entropy partition key (such as a hash of the driver ID and timestamp) and deploy a NAT Gateway or configure VPC endpoints in the VPC.
To achieve optimal shard utilization and avoid throttling, records must be distributed evenly across shards. This is done by using a high-entropy partition key (such as a hash of the driver ID and a timestamp). Additionally, because the Lambda function is deployed within a private VPC subnet, it cannot access public endpoints like Kinesis and EventBridge by default. Providing a NAT Gateway or setting up VPC endpoints allows the function to securely reach these services.

Step-by-Step Solution

1
Analyze partition key strategy for record distribution.
Select a partition key with high entropy to distribute traffic across shards.
Kinesis uses partition keys to determine which shard receives a record. A low-entropy key causes hot shards.
2
Resolve network connectivity for the private subnet Lambda function.
Provision a NAT Gateway in a public subnet or configure interface VPC endpoints (PrivateLink) for Kinesis and EventBridge.
Lambda functions in private subnets cannot access public AWS endpoints directly without a route to the internet or service endpoints.
3
Verify IAM execution role trust relationships.
Ensure the execution role's trust policy targets the Lambda service principal, and grant read/write permissions via policy statements.
AWS Lambda polls the stream and assumes the execution role; Kinesis does not perform the invocation.

Key Concept

Distributing stream records with high-entropy partition keys and enabling public AWS service connectivity for VPC-bound Lambda functions.
Rate this question

Topics

Stream Processing and Event Routing with Amazon Kinesis and EventBridge

More questions from this topic