Examkin

Question

Difficulty: HardServerless Development with AWS Lambda

A developer is building a serverless processing system where an AWS Lambda function is triggered by an Amazon SQS queue. The function is configured to run inside the private subnets of a custom VPC to write processed results to an Amazon RDS database. During execution, the Lambda function needs to retrieve database credentials from AWS Secrets Manager. During initial testing, the database writes are successful, but the function fails to retrieve the credentials from AWS Secrets Manager, resulting in connection timeout errors. In addition, the developer notices that some SQS messages are being processed multiple times. Which two actions should the developer take to resolve these issues?

  1. Create an interface VPC endpoint for AWS Secrets Manager within the VPC, and configure the security groups to allow HTTPS traffic from the Lambda function.Answer
  2. Increase the visibility timeout of the Amazon SQS queue to be at least six times the timeout configuration of the Lambda function.Answer
  3. C
    Move the Lambda function to the public subnets of the VPC and enable the auto-assign public IP setting in the function's configuration.
  4. D
    Increase the Lambda function's timeout configuration to be greater than the SQS queue's visibility timeout to prevent the execution context from recycling.
  5. E
    Modify the Lambda function's IAM execution role trust policy to allow the Secrets Manager service principal to assume the role.

Answer

Create an interface VPC endpoint for AWS Secrets Manager within the VPC, and increase the visibility timeout of the Amazon SQS queue to be at least six times the timeout configuration of the Lambda function.
To resolve the timeout connection to AWS Secrets Manager, the Lambda function running in the private subnet needs a route to the Secrets Manager service. Creating an interface VPC endpoint for Secrets Manager allows the private Lambda function to reach the service using internal AWS routing without traversing the public internet. To resolve the duplicate message processing, the SQS visibility timeout must be increased to be at least six times the Lambda function's timeout. This ensures that the message remains locked and invisible to other consumers while the function executes.

Step-by-Step Solution

1
Analyze the connection timeout to AWS Secrets Manager.
Identify that the Lambda function is in private subnets without public internet routing (no NAT Gateway) and cannot reach the public endpoint of AWS Secrets Manager.
Private VPC Lambda functions require a NAT Gateway or a VPC endpoint to reach public AWS services.
2
Determine the solution for secure private connection to Secrets Manager.
Select the option to create an interface VPC endpoint (PrivateLink) for Secrets Manager in the VPC.
An interface endpoint creates elastic network interfaces in the subnets to route traffic privately and securely to the service.
3
Analyze the duplicate message processing issue.
Determine that the SQS queue's visibility timeout is too short compared to the Lambda function execution time, allowing messages to be picked up by other workers.
SQS visibility timeout must be equal to or greater than the processing time (recommended to be at least 6 times the Lambda timeout) to prevent concurrent processing of the same message.

Key Concept

Configuring VPC connectivity for AWS Lambda and aligning SQS visibility timeouts with Lambda timeouts.
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic