Examkin

Question

Difficulty: MediumVPC Security for Developers

A developer is configuring an AWS Lambda function to run inside a custom VPC. The function needs to retrieve database configuration parameters stored in AWS Systems Manager Parameter Store. The corporate security policy requires that no traffic to Systems Manager may traverse the public internet. During testing, the Lambda function times out whenever it attempts to call the GetParameter API. How should the developer resolve this issue while complying with the security policy?

  1. Create an interface VPC endpoint for Systems Manager in the VPC, and configure the security group of the VPC endpoint to allow inbound HTTPS traffic from the Lambda function's security group.Answer
  2. B
    Associate the Lambda function with a public subnet in the VPC and add a route to the subnet's route table pointing to an Internet Gateway.
  3. C
    Modify the trust policy of the Lambda function's execution role to allow the Systems Manager service principal to assume the role.
  4. D
    Migrate the configuration parameters to AWS Secrets Manager, enable automatic rotation, and configure a Gateway VPC Endpoint for Secrets Manager.

Answer

Create an interface VPC endpoint for Systems Manager in the VPC, and configure the security group of the VPC endpoint to allow inbound HTTPS traffic from the Lambda function's security group.
The correct answer correctly identifies that an interface VPC endpoint (AWS PrivateLink) allows resources inside private subnets to securely connect to Systems Manager over private IP addresses. It also correctly states that the security group of the VPC endpoint must permit inbound HTTPS traffic from the Lambda function's security group.

Step-by-Step Solution

1
Identify the root cause of the timeout.
The Lambda function inside the VPC has no path to the public Systems Manager endpoint.
By default, resources in private subnets cannot reach the public internet or public AWS services without a NAT Gateway or VPC Endpoint.
2
Apply the corporate security constraint.
Discard solutions involving NAT Gateways or Internet Gateways.
The security policy forbids traffic from traversing the public internet.
3
Select the correct private connectivity mechanism.
Determine that Systems Manager supports Interface VPC Endpoints (AWS PrivateLink).
Interface VPC Endpoints assign private IPs within the VPC to route traffic securely to the service.
4
Configure security groups for the endpoint.
Allow inbound port 443 traffic from the Lambda function's security group to the endpoint's security group.
Security groups control the traffic flow between the Lambda function's ENI and the VPC endpoint's ENI.

Key Concept

VPC Security and PrivateLink Interface Endpoints for Lambda
Rate this question

Topics

VPC Security for Developers

More questions from this topic