Examkin

Question

Difficulty: EasyServerless Development with AWS Lambda

An AWS Lambda function is configured to run inside private subnets of a VPC in order to securely read data from an Amazon RDS DB instance. The function must also fetch data from a public weather API endpoint on the internet. Although database queries succeed, all HTTP requests to the public weather API fail with a timeout. Which of the following networking configurations will resolve this issue?

  1. A
    Associate a public IP address directly to the Elastic Network Interfaces (ENIs) assigned to the Lambda function.
  2. B
    Increase the execution timeout configuration of the Lambda function to the maximum value of 15 minutes.
  3. Deploy a NAT Gateway in a public subnet of the VPC and route outbound internet traffic from the private subnets through the NAT Gateway.Answer
  4. D
    Assign an IAM policy to the Lambda function execution role that allows the ec2:AssociateAddress action.

Answer

Deploy a NAT Gateway in a public subnet of the VPC and route outbound internet traffic from the private subnets through the NAT Gateway.
The correct option correctly states that deploying a NAT Gateway in a public subnet and routing outbound internet traffic from the private subnets through it is the standard and recommended way to grant internet access to AWS Lambda functions running in a private VPC subnet.

Step-by-Step Solution

1
Analyze the networking environment of the Lambda function.
The function is running inside private subnets of a VPC, allowing it to communicate with the RDS database in the same VPC but blocking direct internet access.
By default, resources in a private subnet do not have a route to the internet.
2
Identify the requirement for outbound internet access.
To reach the public weather API, the Lambda function needs a way to route traffic out of the VPC to the internet securely.
An Internet Gateway cannot be used directly by private subnets as they lack public IP addresses.
3
Configure the VPC gateway and routing table.
Create a NAT Gateway in a public subnet (which has a route to the Internet Gateway) and add a route of 0.0.0.0/0 to the private subnet's route table pointing to the NAT Gateway.
This allows the private subnet resources to route internet traffic through the NAT Gateway while remaining protected from inbound internet connections.

Key Concept

AWS Lambda VPC networking and outbound internet connectivity requirements.
Estimated Time:1m 0s
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic