A developer is implementing an AWS Lambda function that must query an Amazon Aurora PostgreSQL database located in a private VPC subnet. Additionally, the Lambda function must retrieve database credentials from AWS Secrets Manager and send HTTP POST requests to an external API endpoint over the public internet.
Which network and security configuration should the developer implement to meet these requirements securely while adhering to the principle of least privilege?
- Deploy the Lambda function in the private subnets. Associate a security group with the Lambda function that allows outbound TCP traffic on port to the database security group and outbound HTTPS traffic on port . Configure the private subnets' route table to route traffic to a NAT Gateway located in a public subnet. Configure the database security group to allow inbound traffic on port only from the Lambda function's security group.Answer
- BDeploy the Lambda function in the private subnets. Associate a security group with the Lambda function that allows outbound TCP traffic on port to the database security group and outbound HTTPS traffic on port . Configure the private subnets' route table to route traffic directly to the Internet Gateway. Configure the database security group to allow inbound traffic on port only from the Lambda function's security group.
- CDeploy the Lambda function in the public subnets to ensure it has native internet access to reach Secrets Manager and the external API. Store the database credentials in Systems Manager Parameter Store as a standard String parameter. Configure the database security group to allow inbound traffic on port from the public subnet CIDR blocks.
- DDeploy the Lambda function in the private subnets. Configure the database security group to allow inbound traffic on port from . Attach an IAM policy to the Lambda execution role that allows the `sts:AssumeRole` action on the database, and modify the database's IAM trust policy to trust the Lambda function's execution role.
Answer
Deploy the Lambda function in the private subnets, configure a NAT Gateway in a public subnet to route traffic, and associate a security group with the Aurora database that allows inbound traffic on port only from the Lambda security group.
The correct network configuration places both the Lambda function and the database in private subnets. Outbound internet access for the Lambda function (to access the external payment gateway and public Secrets Manager endpoints) is enabled by routing traffic through a NAT Gateway in a public subnet. Database access is securely restricted at the network layer by configuring the database's security group to allow inbound connections on port only from the Lambda function's security group.
Step-by-Step Solution
Key Concept
AWS Lambda VPC networking, Security Group referencing, and NAT Gateway routing for private-to-public subnet communication.