Examkin

Question

Difficulty: MediumDebugging Lambda Execution and Configuration Issues

A developer has deployed an AWS Lambda function inside a private subnet of a custom VPC to process user registration events. The function needs to retrieve database credentials from AWS Secrets Manager to perform database updates. However, the VPC does not have a NAT Gateway or internet access, and the Lambda function executions are timing out with connection errors to the Secrets Manager service endpoint. Which two actions should the developer take to resolve this issue? (Select TWO.)

  1. Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC.Answer
  2. Configure the security group of the VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group of the Lambda function.Answer
  3. C
    Attach an Internet Gateway to the VPC and configure the private subnet's route table to route all outbound traffic through the Internet Gateway.
  4. D
    Modify the Lambda function configuration to assign a public IP address and place the function in a public subnet.
  5. E
    Increase the Lambda function's timeout configuration to 15 minutes and double the memory allocation to handle connection retries.

Answer

Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC, and configure the security group of the VPC endpoint to allow inbound HTTPS traffic from the security group of the Lambda function.
The correct options are creating an interface VPC endpoint for AWS Secrets Manager and configuring the endpoint's security group to allow inbound HTTPS traffic from the Lambda function. Since the Lambda function is running in a private subnet with no NAT Gateway or internet access, it cannot resolve or connect to the public Secrets Manager API endpoints. Creating an interface VPC endpoint (AWS PrivateLink) creates local ENIs in the subnets, enabling private routing to the service. For the connection to succeed, the security group attached to the VPC endpoint must permit inbound TCP traffic on port 443 from the security group of the Lambda function.

Step-by-Step Solution

1
Analyze the network configuration of the Lambda function and the target service endpoint.
Identify that the Lambda function is running inside a private subnet of a VPC without internet access (no NAT Gateway) and cannot reach the public AWS Secrets Manager endpoint.
By default, Lambda functions inside a VPC require a route to the internet (via a NAT Gateway) or a VPC endpoint to reach public AWS service endpoints.
2
Create an interface VPC endpoint for AWS Secrets Manager.
Establish a private route for the Lambda function to connect to AWS Secrets Manager using internal IP addresses within the VPC.
An interface endpoint powered by AWS PrivateLink allows secure, private connections to supported AWS services without using a NAT Gateway or Internet Gateway.
3
Configure the security groups to allow traffic between the Lambda function and the VPC endpoint.
Ensure that the endpoint's security group allows inbound traffic on port 443 (HTTPS) from the security group assigned to the Lambda function.
Without adjusting the security group rules, the VPC endpoint will block the incoming connection requests from the Lambda function.

Key Concept

Configuring private access to AWS services from a VPC using interface VPC endpoints and proper security group configurations.
Estimated Time:2m 0s
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic