Examkin

Question

Difficulty: HardVPC Security for Developers

An AWS Lambda function is configured to run within private subnets of a custom VPC to securely query an Amazon Aurora database. The function also needs to retrieve database credentials stored as secure strings in AWS Systems Manager Parameter Store. During testing, the Lambda function times out when attempting to retrieve the parameters, though database connectivity works perfectly. A developer confirms that there is no NAT Gateway configured in the VPC.

Which configuration change will resolve the timeout issue while maintaining the current network architecture and database security?

  1. Establish an interface VPC endpoint for Systems Manager (ssm) within the private subnets, associating a security group that allows inbound HTTPS traffic from the Lambda function's security group.Answer
  2. B
    Attach an IAM policy to the Lambda execution role that grants ssm:GetParameters access, which enables the VPC-bound Lambda function to bypass the private subnet's routing table to reach the public Systems Manager service.
  3. C
    Update the trust relationship policy document of the Lambda execution role to allow the Systems Manager service principal (ssm.amazonaws.com) to assume the role and push parameter values.
  4. D
    Migrate the database credentials from Parameter Store to AWS Secrets Manager, as Systems Manager Parameter Store does not support private VPC endpoint connections or secure string encryption.

Answer

Establish an interface VPC endpoint for Systems Manager (ssm) within the private subnets, associating a security group that allows inbound HTTPS traffic from the Lambda function's security group.
The correct answer is to establish an interface VPC endpoint for Systems Manager (ssm) within the private subnets, associating a security group that allows inbound HTTPS traffic from the Lambda function's security group. Since the Lambda function is running in a private subnet with no NAT Gateway, it has no route to the public internet to reach the default Systems Manager endpoint. Creating an interface VPC endpoint places Elastic Network Interfaces (ENIs) with private IP addresses directly in the private subnets. The Lambda function can then access Parameter Store privately over port 443, provided the endpoint's security group allows inbound traffic from the Lambda function's security group.

Step-by-Step Solution

1
Analyze the network configuration of the Lambda function.
The Lambda function resides in a private subnet with no NAT Gateway, preventing access to public AWS service endpoints.
By default, resource-bound Lambda functions route traffic through the VPC's routing tables. Without a NAT Gateway or VPC endpoint, they cannot resolve or connect to public services.
2
Select the correct AWS PrivateLink service endpoint.
Identify that Systems Manager Parameter Store can be accessed privately via an interface VPC endpoint (ssm service).
Interface VPC endpoints provision Elastic Network Interfaces (ENIs) within the subnets, enabling private routing within the AWS network.
3
Configure the security groups for the VPC endpoint.
Associate a security group with the interface VPC endpoint that allows inbound HTTPS (port 443) traffic from the Lambda function's security group.
Since security groups are stateful and default to blocking all inbound traffic, the endpoint's security group must explicitly allow inbound requests from the client (Lambda).

Key Concept

VPC Interface Endpoints (AWS PrivateLink) and Security Group configurations for private AWS service integration.
Estimated Time:2m 30s
Rate this question

Topics

VPC Security for Developers

More questions from this topic