Examkin

Question

Difficulty: EasyVPC Security for Developers

A developer is deploying an AWS Lambda function inside a private subnet of a Virtual Private Cloud (VPC) to access an Amazon RDS database. The Lambda function also needs to connect to an external payment processor's public API over the internet. Which configuration should the developer use to allow the Lambda function to access the internet?

  1. Configure a NAT Gateway in a public subnet, and add a route in the private subnet's route table that directs internet-bound traffic to the NAT Gateway.Answer
  2. B
    Configure the Lambda function to run inside the private subnet without configuring a NAT Gateway or VPC endpoints, assuming the default subnet routing allows outbound internet traffic.
  3. C
    Modify the IAM execution role's trust policy of the Lambda function to permit direct public internet connections to external IP ranges.
  4. D
    Store the payment processor's API key in AWS Systems Manager Parameter Store and enable automatic rotation to open an internet-bound route.

Answer

Configure a NAT Gateway in a public subnet, and add a route in the private subnet's route table that directs internet-bound traffic to the NAT Gateway.
The correct option correctly states that a NAT Gateway must be configured in a public subnet and the private subnet's route table updated to direct destination 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway. This allows Lambda functions inside the private subnet to establish outbound connections to the internet without exposing them to inbound internet traffic.

Step-by-Step Solution

1
Identify that the Lambda function is running inside a private subnet and needs to connect to the public internet.
The Lambda function does not have a public IP address and cannot directly route traffic to an Internet Gateway.
AWS Lambda functions configured in a VPC are assigned private IP addresses only.
2
Select the appropriate network gateway that allows outbound-only internet access for private subnet resources.
Identify a NAT Gateway placed in a public subnet of the same VPC.
A NAT Gateway translates the private IP addresses of resources in private subnets to a public IP to communicate with the internet.
3
Update the routing table associated with the private subnet containing the Lambda function.
Add a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway's ID.
This routes all non-VPC bound traffic (internet traffic) securely to the NAT Gateway.

Key Concept

VPC Routing and NAT Gateway for private subnet resources
Estimated Time:1m 0s
Rate this question

Topics

VPC Security for Developers

More questions from this topic