Examkin

Question

Difficulty: Very hardDebugging Lambda Execution and Configuration Issues

A developer is troubleshooting an AWS Lambda function that processes incoming sensor telemetry. The function is configured to run inside a custom VPC and must write data to an Amazon Aurora PostgreSQL database located in a private VPC subnet. Additionally, the Lambda function must call a public HTTPS endpoint of an external device registry for validation on each invocation.

The function configuration is associated with two subnets: `subnet-0a` (a private subnet with a route to a NAT Gateway) and `subnet-0b` (a public subnet with a route to an Internet Gateway). During execution, the developer observes that connection attempts to the Aurora database succeed 100%100\% of the time. However, approximately 50%50\% of the Lambda invocations fail due to connection timeouts when the function attempts to call the external validation API.

Which of the following actions will resolve the execution timeouts while maintaining access to both the database and the external API?

  1. Modify the Lambda function configuration to associate only with the private subnet (subnet-0a), removing the association with the public subnet (subnet-0b).Answer
  2. B
    Enable public IP assignment on the Elastic Network Interfaces (ENIs) generated by Lambda and assign an Elastic IP to the function's execution role.
  3. C
    Increase the Lambda function timeout from 1010 seconds to 55 minutes and allocate more memory to increase the network bandwidth.
  4. D
    Change the route table of the public subnet (subnet-0b) to direct outbound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway in the private subnet (subnet-0a).

Answer

Modify the Lambda function configuration to associate only with the private subnet (subnet-0a), removing the association with the public subnet (subnet-0b).
The correct answer is to modify the Lambda function configuration to associate only with the private subnet and remove the association with the public subnet. When a Lambda function is configured to run inside a VPC, AWS provisions Elastic Network Interfaces (ENIs) in the specified subnets. These ENIs only receive private IP addresses. If an ENI is placed in a public subnet, outbound internet traffic is directed to the Internet Gateway, which drops the traffic because it cannot map the private IP address to a public source. By removing the public subnet and using only the private subnet associated with a NAT Gateway, all internet-bound traffic goes through the NAT Gateway, which successfully translates the private IP to a public IP and routes the traffic.

Step-by-Step Solution

1
Analyze the network paths and routing configurations for the subnets associated with the Lambda function.
Lambda ENIs are distributed across both `subnet-0a` (private with NAT Gateway) and `subnet-0b` (public with Internet Gateway).
To determine why only 50%50\% of internet connections fail while all database connections succeed.
2
Evaluate the IP allocation behavior of Lambda ENIs within VPC subnets.
Lambda ENIs are assigned only private IP addresses. They do not receive public IP addresses even when deployed in a public subnet.
To verify if outbound traffic from the public subnet can traverse the Internet Gateway.
3
Identify the routing path for outbound traffic from each subnet.
Traffic from `subnet-0a` goes through the NAT Gateway (succeeds). Traffic from `subnet-0b` goes to the Internet Gateway with a private source IP, which is dropped (fails). Database traffic is internal to the VPC and succeeds from both subnets.
To locate the root cause of the intermittent 50%50\% packet drop.
4
Reconfigure the Lambda subnets to exclude the public subnet.
By associating the function only with the private subnet, all ENIs are created in `subnet-0a` and route outbound traffic through the NAT Gateway, achieving 100%100\% success.
To ensure consistent routing and resolve the connection timeouts.

Key Concept

Lambda VPC Networking and Outbound Internet Routing

Alternative Method

Instead of a NAT Gateway, you can configure an interface VPC Endpoint (AWS PrivateLink) for the external API if the third-party provider supports it or if it is an AWS service, which would keep the traffic entirely within the AWS network.
Estimated Time:3m 0s
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic