Examkin

Question

Difficulty: MediumServerless Development with AWS Lambda

A developer is designing an AWS Lambda function that processes customer orders. The function must retrieve configuration parameters from an Amazon ElastiCache for Redis cluster located in the private subnets of a custom VPC. Additionally, for each processed order, the Lambda function must send a confirmation message to a third-party billing API on the public internet. Which configuration will allow the Lambda function to connect to the ElastiCache cluster and successfully call the third-party billing API?

  1. A
    Configure the Lambda function to run inside the VPC by associating it with the public subnets of the VPC. Configure a security group to allow outbound traffic to the private subnets containing the ElastiCache cluster.
  2. B
    Configure the Lambda function to run outside the VPC to maintain its default public internet access. Establish connectivity to the ElastiCache cluster by configuring an Amazon ElastiCache VPC interface endpoint (AWS PrivateLink).
  3. Configure the Lambda function to run inside the VPC by associating it with the private subnets where the ElastiCache cluster is located. Route the outbound internet traffic from these private subnets through a NAT gateway configured in a public subnet.Answer
  4. D
    Configure the Lambda function to run inside the VPC by associating it with the private subnets. Update the trust policy of the Lambda function's IAM execution role to trust the ElastiCache service principal (elasticache.amazonaws.com) to enable secure communication.

Answer

Configure the Lambda function to run inside the VPC by associating it with the private subnets where the ElastiCache cluster is located, and route outbound internet traffic through a NAT gateway in a public subnet.
The correct option outlines the standard and recommended architectural pattern for VPC-enabled Lambda functions requiring internet access. Associating the function with the private subnets puts it in the same network space as the ElastiCache cluster, while routing subnet traffic through a NAT gateway in a public subnet allows the function to access public endpoints.

Step-by-Step Solution

1
Determine the network requirements for the two target resources.
The ElastiCache cluster is inside a private VPC subnet and is not publicly accessible. The third-party API is on the public internet.
This establishes that the Lambda function must have network access to both a private VPC network and the public internet.
2
Configure the Lambda function's VPC attachment.
Associate the Lambda function with the private subnets of the VPC where the ElastiCache cluster is located.
This places the Lambda function in the same network topology, enabling it to communicate with the Redis cluster via internal IP addresses.
3
Configure internet egress for the private subnets.
Route the 0.0.0.0/0 traffic from the private subnets to a NAT gateway located in a public subnet of the VPC.
Because Lambda ENIs inside a VPC do not receive public IP addresses, they cannot route traffic directly to an Internet Gateway. A NAT gateway allows resources in private subnets to make outbound connections to the internet.

Key Concept

AWS Lambda VPC networking and internet access for private subnet resources.
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic