Examkin

Question

Difficulty: MediumServerless Development with AWS Lambda

A developer is working on an AWS Lambda function that retrieves transaction data from an Amazon RDS PostgreSQL database running in a private subnet of a VPC. The function must also send an HTTP request to a third-party payment processor endpoint on the public internet. The developer configures the Lambda function to run inside the same VPC and private subnets as the database. Testing reveals that the Lambda function successfully queries the database but times out when attempting to connect to the payment processor.

Which configuration change should the developer make to resolve this connection timeout?

  1. Configure a NAT Gateway in a public subnet of the VPC, and add a route in the route table of the Lambda function's subnets to direct internet-bound traffic to the NAT Gateway.Answer
  2. B
    Move the Lambda function's subnet configuration to the public subnets of the VPC to allow it to utilize the VPC's Internet Gateway directly.
  3. C
    Enable the 'Assign Public IP' option in the Lambda function's VPC settings and associate an Elastic IP address with the function's network interface.
  4. D
    Modify the trust policy of the Lambda function's execution role to allow the VPC service principal to assume the role, and attach the AWSLambdaVPCAccessExecutionRole policy.

Answer

Configure a NAT Gateway in a public subnet of the VPC, and add a route in the route table of the Lambda function's subnets to direct internet-bound traffic to the NAT Gateway.
The correct action is to route internet-bound traffic through a NAT Gateway. When a Lambda function is configured to run inside a VPC, it accesses resources via Elastic Network Interfaces (ENIs) allocated in the configured subnets. Since these ENIs do not have public IP addresses, they cannot communicate directly with the internet, even if placed in a public subnet. To enable internet connectivity, the function must be placed in private subnets, and the corresponding route table must route all external traffic (0.0.0.0/0) to a NAT Gateway deployed in a public subnet.

Step-by-Step Solution

1
Analyze the network route paths for the Lambda function inside the VPC.
The Lambda function is in a private subnet with route paths to the database, but it has no route to the internet.
Since Lambda ENIs do not have public IPs, they cannot use an Internet Gateway directly even if placed in a public subnet.
2
Introduce a NAT Gateway into the network architecture.
A NAT Gateway is created in a public subnet of the VPC, which has a route to the Internet Gateway.
The NAT Gateway acts as a proxy, translating private IPs to its own public IP for outgoing internet traffic.
3
Update the routing table of the Lambda function's private subnet.
A route for 0.0.0.0/0 pointing to the NAT Gateway is added to the private subnet's route table.
This directs all external traffic from the Lambda function through the NAT Gateway, resolving the connection timeout.

Key Concept

VPC Networking for AWS Lambda
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic