Examkin

Question

Difficulty: MediumDebugging Lambda Execution and Configuration Issues

An order processing workflow runs on AWS Lambda and needs to interact with an Amazon RDS PostgreSQL database located inside a private subnet of a VPC. Additionally, the function must publish event messages to an external third-party shipping API. The Lambda function is configured with access to the same private subnets as the database. While database operations succeed, the outbound HTTP requests to the shipping API fail with connection timeout errors.

Which TWO network configuration steps will resolve the outbound connectivity issue to the shipping API?

  1. Configure a NAT Gateway within a public subnet of the VPC.Answer
  2. Update the route table of the private subnets to route traffic destined for 0.0.0.0/0 to the NAT Gateway.Answer
  3. C
    Attach an Internet Gateway directly to the private subnets and add a default route pointing to it.
  4. D
    Configure the Lambda function to use public subnets and enable public IP address allocation.
  5. E
    Increase the execution timeout and allocated memory of the Lambda function to prevent the shipping API connection from timing out.

Answer

The correct actions are to configure a NAT Gateway within a public subnet of the VPC, and to update the route table of the private subnets to route traffic destined for 0.0.0.0/0 to that NAT Gateway.
When an AWS Lambda function is configured to run inside a VPC, it utilizes Hyperplane ENIs to connect to the designated subnets. If it is attached to private subnets to communicate with internal resources like databases, it does not have access to the public internet by default. To resolve this, a NAT Gateway must be provisioned in a public subnet (which has a route to an Internet Gateway), and the route table associated with the Lambda function's private subnets must direct all outbound traffic (0.0.0.0/0) to the NAT Gateway.

Step-by-Step Solution

1
Analyze the network path for the Lambda function.
The Lambda function is running in private subnets to reach the database, meaning it lacks direct internet routing.
By default, Lambda functions associated with private subnets have no route to public endpoints unless configured with a gateway or translation instance.
2
Select the correct translation mechanism.
Deploying a NAT Gateway in a public subnet provides the necessary Network Address Translation for private resources.
A NAT Gateway maps private IP addresses to a public IP to facilitate outbound connections while shielding internal resources from unsolicited inbound traffic.
3
Configure the routing paths for outbound traffic.
Modify the route table associated with the private subnets where the Lambda function runs to forward 0.0.0.0/0 traffic to the NAT Gateway.
Resources in private subnets require an explicit route table entry pointing to the NAT Gateway to exit the VPC.

Key Concept

Lambda VPC Networking and Internet Access
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic