Examkin

Question

Difficulty: HardDebugging Lambda Execution and Configuration Issues

A developer is implementing a serverless data-processing pipeline. An AWS Lambda function is configured to run inside a VPC, associated with two private subnets. The function reads telemetry metadata from an Amazon ElastiCache for Redis cluster in the same VPC, uses AWS Key Management Service (AWS KMS) to decrypt payload fields, and writes the results to an Amazon DynamoDB table. During testing, the Lambda function consistently times out after its configured limit of 15 seconds. The function's IAM execution role contains permissions for KMS decryption and DynamoDB writing, and the security group associated with the Lambda function allows all outbound traffic. What is the root cause of these execution timeouts?

  1. The private subnets do not have a route to a NAT Gateway, and no VPC Endpoints are configured for AWS KMS and DynamoDB, preventing the function from reaching their public endpoints.Answer
  2. B
    The Lambda function is not configured to run in public subnets of the VPC with an assigned public IP address, which is required to establish direct outbound connections to public AWS endpoints.
  3. C
    The Lambda execution context is reusing the KMS client across warm starts, causing the client connection pool to exhaust socket descriptors and block subsequent requests.
  4. D
    The AWS SDK clients for KMS and DynamoDB within the Lambda function are not explicitly initialized with static AWS access keys, which is required for authentication when executing inside a VPC.

Answer

The private subnets do not have a route to a NAT Gateway, and no VPC Endpoints are configured for AWS KMS and DynamoDB, preventing the function from reaching their public endpoints.
The correct answer is the option indicating that the private subnets lack a route to a NAT Gateway or the necessary VPC Endpoints. When a Lambda function is configured to run inside a VPC, it loses its default internet access. To connect to public AWS services such as AWS KMS and DynamoDB, the function's subnets must route traffic through a NAT Gateway or utilize VPC Endpoints (Interface Endpoint for KMS, and Gateway Endpoint for DynamoDB) to keep the traffic within the AWS network. Without this routing, calls to KMS and DynamoDB will hang and cause the function to time out.

Step-by-Step Solution

1
Analyze the network placement of the Lambda function and the target endpoints.
The Lambda function is placed inside private VPC subnets to communicate with ElastiCache for Redis (a VPC resource). It also needs to connect to AWS KMS and DynamoDB, which are public AWS services.
Understanding the destination of outbound network calls helps identify if they require public internet access or VPC endpoint routing.
2
Evaluate the default network behavior of VPC-enabled Lambda functions.
Once a Lambda function is attached to a VPC, all its outbound internet access is disabled by default.
This explains why the function can reach ElastiCache (local to the VPC) but cannot reach public AWS endpoints without additional configuration.
3
Determine the necessary routing configuration to restore access to public endpoints.
To access public endpoints, the VPC must have a NAT Gateway in a public subnet with a route in the private subnet's route table, or VPC Endpoints (Gateway for DynamoDB, Interface for KMS) must be provisioned inside the VPC.
Without a NAT Gateway or VPC Endpoints, the TCP connection attempts to AWS KMS and DynamoDB will hang indefinitely, leading to execution timeouts.

Key Concept

VPC Networking for AWS Lambda and Access to Public AWS Services
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic