Examkin

Question

Difficulty: MediumDebugging Lambda Execution and Configuration Issues

An AWS Lambda function is configured to run inside private subnets of a custom VPC to retrieve records from an Amazon RDS PostgreSQL database. After retrieving the records, the function attempts to upload a compiled report to an Amazon S3 bucket. The function successfully connects to the database but consistently times out when attempting to write to the S3 bucket. The VPC has no NAT Gateway or internet connectivity. Which action should the developer take to resolve this execution issue?

  1. A
    Move the Lambda function to a public subnet within the VPC and enable the auto-assign public IP configuration.
  2. B
    Increase the Lambda function's execution timeout limit to 15 minutes to allow the connection retry attempts to succeed.
  3. Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the Lambda function's subnets.Answer
  4. D
    Modify the Lambda function's IAM execution role to include the s3:PutObject permission for the target S3 bucket.

Answer

Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the Lambda function's subnets.
The correct answer is to create a Gateway VPC Endpoint for Amazon S3. When a Lambda function runs inside a custom VPC without internet egress (no NAT Gateway), it can communicate locally but cannot reach public AWS endpoints. A Gateway VPC Endpoint establishes private connectivity to Amazon S3 directly from the private subnet's route table.

Step-by-Step Solution

1
Analyze execution symptoms
Database access succeeds, but S3 upload hangs and times out.
Since database access works, the function's VPC configuration is correct for internal routing, but the lack of public access blocks direct S3 uploads.
2
Check VPC egress design
Identify that the VPC has no NAT Gateway or public internet route.
S3 is a public service, so requests to it from a private VPC subnet require either NAT egress or a direct VPC endpoint.
3
Configure a Gateway VPC Endpoint
A Gateway VPC Endpoint for S3 is provisioned and linked to the subnet's route table.
Gateway endpoints allow secure, private routing of S3 traffic without routing traffic over the public internet.

Key Concept

Debugging network routing for Lambda functions configured inside a custom VPC
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic