Examkin

Question

Difficulty: EasyVPC Security for Developers

A developer has configured an AWS Lambda function to run inside private subnets of a VPC. The function needs to connect to an external, third-party payment gateway API on the public internet, but the connection attempts are failing due to timeouts. Which configuration change should the developer implement to allow the Lambda function to connect to the external API?

  1. Deploy a NAT Gateway in a public subnet, and add a route in the private subnet's route table directing outbound 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway.Answer
  2. B
    Configure the private subnet's route table to route outbound 0.0.0.0/00.0.0.0/0 traffic directly to the VPC's Internet Gateway.
  3. C
    Update the trust policy of the Lambda function's IAM execution role to explicitly allow connections to the payment gateway API domain.
  4. D
    Store the payment gateway API URL in Systems Manager Parameter Store and enable automatic parameter rotation.

Answer

Deploy a NAT Gateway in a public subnet, and add a route in the private subnet's route table directing outbound traffic to the NAT Gateway.
The correct answer provides a valid network path for the Lambda function. Since the Lambda function is placed in a private subnet, it has no public IP address and cannot directly route traffic to an Internet Gateway. Deploying a NAT Gateway in a public subnet and routing the private subnet's outbound traffic to the NAT Gateway allows the Lambda function to reach public endpoints securely.

Step-by-Step Solution

1
Analyze the network requirements of the Lambda function.
The Lambda function is inside private subnets of a VPC and needs to access an endpoint on the public internet.
Since the Lambda is within a VPC private subnet, it lacks a path to the public internet by default.
2
Select the correct AWS VPC component to enable outbound-only internet connectivity.
A NAT Gateway must be deployed in a public subnet of the VPC.
A NAT Gateway translates private IP addresses to a public IP to facilitate outbound communication with the internet.
3
Update the routing configuration of the private subnet.
Add a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.
This ensures all internet-bound traffic from the Lambda function is correctly forwarded to the NAT Gateway.

Key Concept

Outbound internet connectivity for VPC-enabled Lambda functions requires a NAT Gateway and appropriate route table entries.
Estimated Time:1m 0s
Rate this question

Topics

VPC Security for Developers

More questions from this topic