Examkin

Question

Difficulty: Very hardDebugging Lambda Execution and Configuration Issues

A developer is deploying a backend compliance service using an AWS Lambda function. The function is configured to connect to an Amazon Aurora PostgreSQL database in a private subnet, and it also calls a third-party compliance verification HTTPS endpoint on the internet.

The Lambda function is configured with:
- Execution timeout: 30 seconds30\text{ seconds}
- Memory: 512 MB512\text{ MB}
- VPC configuration: Attached to Subnet A and Subnet B
- Security Group: Outbound allows all traffic (`0.0.0.0/0`); Inbound is restricted.

Subnet A's route table has a route for `0.0.0.0/0` pointing to a NAT Gateway located in a public subnet. However, Subnet B's route table has a route for `0.0.0.0/0` pointing directly to an Internet Gateway.

During testing under high concurrency, the developer observes two issues in Amazon CloudWatch Logs:
1. The Lambda function intermittently fails with a timeout error after 30 seconds30\text{ seconds} during peak traffic. The database client connection pool is initialized outside the Lambda handler function.
2. The function fails to connect to the third-party compliance verification endpoint, throwing a network connection timeout, but only during execution threads that run in Subnet B.

Which two actions should the developer take to resolve these execution and configuration issues?

  1. Associate Subnet B with a route table that routes outbound traffic (`0.0.0.0/0`) to the NAT Gateway instead of the Internet Gateway.Answer
  2. Deploy an Amazon RDS Proxy between the Lambda function and the Aurora PostgreSQL database, and update the function to connect to the proxy endpoint.Answer
  3. C
    Enable public IP address assignment in the Lambda function's VPC configuration settings.
  4. D
    Move the database client connection pool initialization inside the Lambda handler function so that a new database connection is created and closed on every invocation.
  5. E
    Configure an inbound security group rule for the Lambda function that allows traffic from the NAT Gateway on port 443443.

Answer

Associate Subnet B with a route table that routes outbound traffic to the NAT Gateway instead of the Internet Gateway, and deploy an Amazon RDS Proxy between the Lambda function and the Aurora PostgreSQL database.
To resolve the internet connectivity issue in Subnet B, the subnet must route internet-bound traffic through the NAT Gateway. Lambda functions running in a VPC do not get public IPs and cannot communicate with the internet directly via an Internet Gateway. To resolve the database connection exhaustion under concurrent load, an Amazon RDS Proxy should be deployed. The proxy handles database connection pooling and efficiently shares connections across Lambda execution environments, preventing connection limits from being breached and avoiding function execution timeouts.

Step-by-Step Solution

1
Analyze the network connection timeout to the external HTTPS endpoint occurring only in Subnet B.
Subnet B routes outbound traffic directly to an Internet Gateway. However, Lambda functions in a VPC do not receive public IP addresses, meaning they cannot route traffic directly through an Internet Gateway.
This explains why executions in Subnet B fail to reach the internet, while Subnet A executions succeed via the NAT Gateway.
2
Determine the required VPC networking correction for Subnet B.
Change the routing of Subnet B so that its route table directs outbound traffic (`0.0.0.0/0`) to the NAT Gateway rather than the Internet Gateway.
This routes Subnet B's internet traffic through the NAT Gateway, which performs NAT translation using its public IP address.
3
Analyze the database connection and execution timeouts under high concurrency.
When Lambda scales out concurrently, each container creates its own connection pool. These multiple pools quickly exceed the maximum connection limit of the Aurora PostgreSQL database, causing subsequent Lambda executions to block indefinitely and time out.
This explains why initializing the pool outside the handler does not prevent database-side connection exhaustion at scale.
4
Determine the proper connection management solution.
Deploy an Amazon RDS Proxy between the Lambda function and the database.
RDS Proxy pools database connections and shares them across multiple Lambda execution environments, preventing connection exhaustion and reducing execution timeout issues.

Key Concept

VPC networking routing rules for AWS Lambda and database connection management at scale.
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic