Examkin

Question

Difficulty: MediumDebugging Lambda Execution and Configuration Issues

A developer is troubleshooting an AWS Lambda function that processes customer orders and writes them to an Amazon RDS PostgreSQL database located in a private subnet. The Lambda function is configured to run inside the same VPC and private subnets. Additionally, the Lambda function must call a third-party payment gateway endpoint on the public internet. During execution, the Lambda function successfully connects to the database but fails with a timeout error when attempting to reach the payment gateway. Which configuration change is required to resolve this execution issue?

  1. Deploy a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table directing destination traffic of 0.0.0.0/00.0.0.0/0 to the NAT Gateway.Answer
  2. B
    Associate the Lambda function with the public subnets of the VPC to allow direct outbound communication via the VPC's Internet Gateway.
  3. C
    Increase the execution timeout limit of the Lambda function to 1515 minutes to accommodate the external payment gateway response times.
  4. D
    Attach an Internet Gateway directly to the Lambda function's elastic network interface (ENI) and assign a public IP address using the Lambda configuration console.

Answer

Deploy a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table directing destination traffic of 0.0.0.0/00.0.0.0/0 to the NAT Gateway.
The correct answer is correct because AWS Lambda functions configured within a VPC do not receive public IP addresses on their elastic network interfaces (ENIs). Consequently, they cannot communicate directly with the internet through an Internet Gateway. To access public endpoints while remaining inside a VPC, the Lambda function must run in private subnets, and the outbound traffic must be routed through a NAT Gateway positioned in a public subnet.

Step-by-Step Solution

1
Analyze the symptoms and network path.
The Lambda function successfully connects to the RDS database in the private subnet but fails to reach the external public internet endpoint, resulting in a timeout.
This confirms that VPC-internal routing is functional, but outbound internet routing from the Lambda's private subnets is blocked or missing.
2
Evaluate Lambda networking constraints in a VPC.
Understand that Lambda ENIs lack public IP addresses and cannot utilize an Internet Gateway directly, even if placed in a public subnet.
To communicate with the public internet from within a VPC, Lambda requires a NAT Gateway or NAT instance located in a public subnet.
3
Configure the private subnet routing.
Configure a NAT Gateway in a public subnet and add a route for 0.0.0.0/00.0.0.0/0 pointing to this NAT Gateway in the private subnet's route table.
This configuration allows the Lambda function to route its internet-bound traffic through the NAT Gateway, resolving the connection timeout.

Key Concept

VPC Networking for AWS Lambda Functions
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic