Examkin

Question

Difficulty: HardServerless Development with AWS Lambda

An e-commerce application's user onboarding workflow relies on an AWS Lambda function. The function is placed inside a private subnet of a custom VPC to securely query an Amazon Aurora PostgreSQL database. During a high-traffic promotional campaign, the application experiences two issues: the function fails to establish database connections because the database's maximum connection limit is exceeded, and it cannot connect to an external third-party identity verification API, resulting in network connection timeouts. Which two configuration modifications will resolve these issues?

  1. Configure the route table of the private subnets where the Lambda function is deployed to route outbound traffic (0.0.0.0/00.0.0.0/0) to a NAT Gateway located in a public subnet.Answer
  2. Create an Amazon RDS Proxy for the Aurora database and update the Lambda function's database connection string to use the proxy endpoint.Answer
  3. C
    Deploy the Lambda function in public subnets of the VPC and assign a public IP address to allow direct outbound communication.
  4. D
    Initialize the database connection pool inside the Lambda handler function to guarantee that connections are closed when the execution terminates.
  5. E
    Create a VPC Gateway Endpoint in the route table of the Lambda function's subnets to establish a private route to the external identity verification API.

Answer

To resolve the issues, the developer must configure the route table of the private subnets to route outbound traffic through a NAT Gateway located in a public subnet, and create an Amazon RDS Proxy for the database while updating the function's connection string to use the proxy endpoint.
Configuring a NAT Gateway in a public subnet and routing all outbound internet traffic from the private subnets to it allows the Lambda function to securely reach external APIs. Creating an Amazon RDS Proxy pools database connections, preventing the function from exhausting Aurora's connection pool as it scales horizontally.

Step-by-Step Solution

1
Analyze the database connection limit issue.
Identify that the Lambda function's rapid scaling creates a new database connection for each concurrent execution, exhausting database connection limits.
AWS Lambda functions scale out horizontally in response to traffic, making traditional database connection pools difficult to manage directly.
2
Resolve database connection limit exhaustion.
Choose to use Amazon RDS Proxy to pool and share database connections across concurrent executions.
RDS Proxy acts as an intermediary database proxy that pools connections, reducing CPU and memory overhead on the database and allowing more concurrent Lambda invocations.
3
Analyze the network timeout issue when connecting to the external API.
Determine that the Lambda function is in private VPC subnets and lacks internet connectivity because there is no route to the internet.
By default, Lambda functions attached to a private subnet in a custom VPC cannot access the public internet without a NAT Gateway or similar NAT device.
4
Resolve the external API connectivity issue.
Configure a NAT Gateway in a public subnet and add a route in the private subnet's route table directing all outbound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway.
The NAT Gateway translates private IP addresses to public IPs, allowing secure outbound-only communication from the private subnets to the external API.

Key Concept

AWS Lambda VPC networking configuration and RDS database connection management
Estimated Time:2m 30s
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic