A developer is configuring an AWS Lambda function that runs inside a private subnet of a VPC. The Lambda function needs to securely download external libraries from a public repository on the internet and retrieve configuration parameters from AWS Systems Manager Parameter Store. Which of the following VPC configurations are required to meet these requirements? (Select TWO.)
- Configure a route in the private subnet's route table that directs outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet.Answer
- Create an Interface VPC Endpoint (AWS PrivateLink) for Systems Manager (ssm) and associate it with the private subnets.Answer
- CDeploy the Lambda function directly in a public subnet with an attached Internet Gateway to allow direct outbound internet access.
- DStore the registry access credentials in AWS Systems Manager Parameter Store and enable native automatic secret rotation.
- EModify the IAM trust policy of the Lambda execution role to allow the Systems Manager service principal (ssm.amazonaws.com) to assume the role.
Answer
Configure a route in the private subnet's route table that directs outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet, and create an Interface VPC Endpoint (AWS PrivateLink) for Systems Manager (ssm) associated with the private subnets.
The correct configurations involve routing private subnet outbound internet traffic to a NAT Gateway in a public subnet, and establishing an Interface VPC Endpoint for Systems Manager. This allows the Lambda function to securely communicate with both the public internet and AWS Systems Manager privately.
Step-by-Step Solution
Key Concept
VPC Egress and VPC Endpoints for Lambda