Examkin

Question

Difficulty: HardVPC Security for Developers

A developer is configuring a backend microservice running on AWS Lambda within a custom VPC. The Lambda function must connect to a private Amazon Aurora PostgreSQL database in the same VPC and retrieve secure configurations from AWS Systems Manager Parameter Store. The company's security policy strictly prohibits internet gateways and NAT gateways. The developer sets up an Interface VPC Endpoint for Systems Manager. Which two configurations must the developer implement to secure this traffic and establish connectivity? (Select TWO.)

  1. Configure the database's security group to allow inbound TCP traffic on port 54325432 from the security group assigned to the Lambda function.Answer
  2. Configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port 443443) traffic from the security group assigned to the Lambda function.Answer
  3. C
    Add a route in the private subnet route table pointing destination 0.0.0.0/00.0.0.0/0 to the Systems Manager VPC Endpoint network interface.
  4. D
    Configure the private subnet's Network Access Control List (NACL) to allow inbound traffic from the database, relying on the stateful nature of NACLs to permit return traffic.
  5. E
    Modify the Lambda execution role's trust policy to allow the Systems Manager service endpoint (ssm.amazonaws.com) to assume the role.

Answer

Configure the database's security group to allow inbound TCP traffic on port 54325432 from the security group assigned to the Lambda function, and configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port 443443) traffic from the security group assigned to the Lambda function.
The database security group must allow inbound PostgreSQL traffic (port 54325432) from the Lambda function's security group. Interface VPC endpoints use security groups to control incoming traffic; therefore, the Systems Manager endpoint's security group must permit inbound HTTPS (port 443443) traffic from the Lambda function's security group. Since security groups are stateful, configuring these inbound rules automatically allows the corresponding outbound/return traffic.

Step-by-Step Solution

1
Analyze database connectivity requirements.
Identify that the Lambda function must connect to Aurora PostgreSQL on port 54325432.
To authorize this traffic, the database's security group must permit inbound traffic from the source (the Lambda function's security group).
2
Analyze Systems Manager Parameter Store connectivity requirements.
Identify that the Lambda function must connect to Systems Manager via an Interface VPC Endpoint using HTTPS on port 443443.
To authorize this traffic, the endpoint's security group must allow inbound traffic from the Lambda function's security group.
3
Evaluate security group statefulness.
Recognize that because security groups are stateful, return traffic is automatically allowed once the inbound/outbound connection is established.
This eliminates the need to configure ephemeral port rules on the security groups.

Key Concept

VPC security controls (Security Groups, NACLs, and Interface VPC Endpoints) for private AWS service integrations.
Estimated Time:2m 30s
Rate this question

Topics

VPC Security for Developers

More questions from this topic