Examkin

Question

Difficulty: MediumDebugging Lambda Execution and Configuration Issues

A development team has deployed a microservice using AWS Lambda. The function is associated with private subnets in a custom VPC so it can securely access an internal Amazon Aurora MySQL database. Additionally, this function must send transaction logs to a public SaaS logging endpoint. While the database operations are performing correctly, all attempts to connect to the external SaaS endpoint result in timeout errors. How can this connectivity issue be resolved?

  1. Set up a NAT Gateway within a public subnet, and update the route table of the private subnets to forward traffic destined for 0.0.0.0/0 to the NAT Gateway.Answer
  2. B
    Associate the function with the public subnets of the VPC and enable the auto-assign public IP setting on those subnets.
  3. C
    Add a route in the route table of the private subnets that routes all traffic destined for 0.0.0.0/0 directly to the VPC's Internet Gateway.
  4. D
    Increase the function's execution timeout to the maximum limit and modify the code to initialize the database connection pool globally outside the handler function.

Answer

Set up a NAT Gateway within a public subnet, and update the route table of the private subnets to forward traffic destined for 0.0.0.0/0 to the NAT Gateway.
For a Lambda function associated with a VPC to access the public internet, it must be placed in private subnets with a route to a NAT Gateway in a public subnet. The NAT Gateway then forwards the traffic to the Internet Gateway. This allows the Lambda function to maintain connectivity to both the internal database (via local VPC routing) and the external endpoint.

Step-by-Step Solution

1
Analyze the network paths for the two destinations.
Database access succeeds because it is local to the VPC, but SaaS endpoint access fails because there is no route to the internet from the private subnets.
Identify if the block is due to local VPC routing or internet routing.
2
Evaluate how Lambda handles internet access inside a VPC.
Lambda requires a NAT Gateway or VPC endpoint because its network interfaces do not get public IPs, preventing direct Internet Gateway usage.
Determine the required network translation component.
3
Formulate the correct routing rules.
Place a NAT Gateway in a public subnet and route 0.0.0.0/0 from the private subnet's route table to the NAT Gateway.
Establish outbound routing for the private resources.

Key Concept

VPC networking for AWS Lambda functions requiring internet access
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic