Examkin

Question

Difficulty: MediumVPC Security for Developers

A developer is building a serverless integration service. An AWS Lambda function is configured to run inside a custom VPC to process sensitive data. The function must poll messages from an Amazon SQS queue, store the processed data in an Amazon Aurora PostgreSQL database located in a private database subnet, and send a confirmation payload to an external HTTP webhook API on the public internet.

Which two configurations are required to ensure the Lambda function has the necessary network paths and security settings?

  1. Configure the Lambda function to run in the private subnets of the VPC, and configure a route in the subnet route tables directing 0.0.0.0/00.0.0.0/0 to a NAT Gateway located in a public subnet.Answer
  2. Configure the Security Group of the Aurora PostgreSQL database to allow inbound traffic on port 54325432 from the Security Group associated with the Lambda function.Answer
  3. C
    Configure the Lambda function to run in public subnets with an assigned public IP address to allow direct outbound access to the external webhook.
  4. D
    Create a Gateway VPC Endpoint for Amazon SQS and associate it with the route tables of the private subnets to allow private polling of SQS messages.
  5. E
    Modify the IAM trust policy of the Lambda function's execution role to allow the Amazon SQS service to assume the role and push messages directly to the function's execution context.

Answer

Configure the Lambda function to run in private subnets with a route to a NAT Gateway, and configure the database's Security Group to allow inbound traffic from the Lambda function's Security Group.
To allow the Lambda function to connect to the private database, the database security group must authorize inbound traffic on port 54325432 from the Lambda function's security group. To allow the function to reach the external HTTP webhook on the public internet, the Lambda function must run in private subnets with a route directing outbound traffic to a NAT Gateway in a public subnet.

Step-by-Step Solution

1
Analyze database connectivity requirements
The Lambda function needs to connect to Aurora PostgreSQL on port 54325432. The database's security group must authorize inbound traffic on port 54325432 originating from the security group assigned to the Lambda function.
Security groups act as firewalls at the instance/resource level and must be configured for stateful communication.
2
Analyze internet connectivity requirements
The Lambda function needs to call an external webhook. A VPC-enabled Lambda function must be placed in private subnets with a route directing 0.0.0.0/00.0.0.0/0 to a NAT Gateway.
VPC-enabled Lambda functions do not receive public IP addresses and cannot connect directly to the internet from a public subnet.
3
Evaluate SQS connectivity requirements
SQS traffic can flow either via the NAT Gateway or through an Interface VPC Endpoint. SQS does not support Gateway VPC Endpoints.
Only Amazon S3 and DynamoDB support Gateway VPC Endpoints; all other supported services use Interface VPC Endpoints.

Key Concept

VPC networking configurations for AWS Lambda, including NAT Gateway routing, security groups, and VPC endpoint types.
Rate this question

Topics

VPC Security for Developers

More questions from this topic