Examkin

Question

Difficulty: MediumStream Processing and Event Routing with Amazon Kinesis and EventBridge

A developer is implementing a real-time data processing pipeline where an AWS Lambda function consumes batches of records from an Amazon Kinesis Data Stream. To securely write the processed results to an Amazon RDS database instance, the Lambda function is configured to run inside a private subnet of a Virtual Private Cloud (VPC). During testing, the Lambda function fails to retrieve records from the Kinesis Data Stream and consistently times out. Which of the following configurations should the developer implement to resolve this connection issue?

  1. A
    Configure the Lambda function's VPC settings to enable a public IP address and configure the security group to allow outbound traffic to all destinations.
  2. B
    Modify the Lambda function's trust policy to allow the Kinesis service principal (kinesis.amazonaws.com) to assume the execution role.
  3. Configure an interface VPC endpoint (AWS PrivateLink) for Amazon Kinesis in the VPC, or route the private subnet traffic through a NAT Gateway in a public subnet.Answer
  4. D
    Increase the Lambda function's execution timeout to 15 minutes to allow the runtime to reuse the container context and establish connection pools during initialization.

Answer

Configure an interface VPC endpoint (AWS PrivateLink) for Amazon Kinesis in the VPC, or route the private subnet traffic through a NAT Gateway in a public subnet.
The correct answer is to configure an interface VPC endpoint or route traffic through a NAT Gateway. This is correct because Lambda functions deployed inside a private subnet of a VPC do not have public IP addresses or route tables that directly point to the internet. Since the Kinesis API endpoint is located on the public internet, the Lambda function needs a way to route traffic out of the VPC to reach Kinesis. An interface VPC endpoint (AWS PrivateLink) allows the Lambda function to connect privately to Kinesis using private IP addresses within the VPC, without requiring traffic to traverse the public internet. Alternatively, a NAT Gateway placed in a public subnet allows the Lambda function to route its internet-bound traffic through the NAT Gateway and Internet Gateway to reach public AWS service endpoints.

Step-by-Step Solution

1
Identify the networking state of the Lambda function.
The Lambda function is deployed in a private VPC subnet and does not have a route to the public internet where the standard Amazon Kinesis endpoint resides.
To determine why the Lambda function is experiencing timeouts when communicating with Kinesis.
2
Determine the mechanism to allow VPC resources to reach public AWS services.
Traffic must either be routed to a NAT Gateway in a public subnet or directed through an Interface VPC Endpoint (AWS PrivateLink) specifically for Kinesis.
To establish a network path from the private subnet to the Kinesis service.
3
Select the matching configuration that establishes this network path.
The configuration using an interface VPC endpoint or a NAT Gateway.
To resolve the timeout and enable successful record retrieval from the Kinesis Data Stream.

Key Concept

VPC Networking and Connectivity for AWS Lambda stream consumers
Rate this question

Topics

Stream Processing and Event Routing with Amazon Kinesis and EventBridge

More questions from this topic