Examkin

Question

Difficulty: MediumStream Processing and Event Routing with Amazon Kinesis and EventBridge

A developer is configuring an AWS Lambda function to process real-time financial transactions from an Amazon Kinesis Data Stream. The function must validate each transaction by invoking a third-party payment gateway's public API endpoint over the internet, and then save the transaction status to an Amazon RDS database located in a private subnet of a VPC.

The developer configures the Lambda function to run inside the same VPC and private subnet as the RDS database. During testing, the developer observes that the Lambda function is successfully triggered by the Kinesis stream but consistently times out after 15 seconds without executing the API call or database write.

What is the root cause of this issue and how should it be resolved?

  1. A
    The execution role associated with the Lambda function is missing a trust policy allowing Kinesis to assume it. The developer must add the kinesis.amazonaws.com service principal to the trust relationship policy of the role.
  2. B
    The Lambda function's timeout is set to a default value that is too low to process the batch size. The developer must increase the Lambda function execution timeout to 15 minutes to allow the function to complete the API calls and database writes.
  3. The Lambda function lacks internet access because it is deployed in a private VPC subnet without a route to a NAT Gateway. The developer must add a NAT Gateway in a public subnet and update the private subnet's route table to route external traffic to the NAT Gateway.Answer
  4. D
    The producer application is using a partition key with low entropy to write records to Kinesis. The developer must change the partition key to a high-entropy value like a transaction ID to distribute the load and prevent Lambda execution bottlenecks.

Answer

The Lambda function lacks internet access because it is deployed in a private VPC subnet without a route to a NAT Gateway. The developer must add a NAT Gateway in a public subnet and update the private subnet's route table to route external traffic to the NAT Gateway.
When a Lambda function is configured to connect to a VPC, it is assigned an ENI to communicate with VPC resources like RDS. However, it loses its default public internet connectivity. To allow the function to call a third-party API over the internet, a NAT Gateway must be configured in a public subnet of the VPC, and the route table of the Lambda function's private subnet must have a route pointing 0.0.0.0/0 to the NAT Gateway.

Step-by-Step Solution

1
Analyze the network path required for the Lambda function's operations.
The Lambda function needs to connect to a private RDS instance (inside the VPC) and a public third-party API endpoint (outside the VPC).
This establishes that both internal VPC and external internet routing are required.
2
Determine the impact of VPC configuration on Lambda outbound connectivity.
Configuring a Lambda function to run inside a private VPC subnet enables local VPC access but removes default outbound internet access.
By default, Lambda functions in a VPC do not have access to the internet unless routed through a NAT Gateway or using VPC endpoints.
3
Select the correct networking components to enable outbound internet access from the private subnet.
A NAT Gateway must be deployed in a public subnet, and the route table for the private subnet must route 0.0.0.0/0 traffic to the NAT Gateway.
This allows the Lambda function to reach the public third-party API endpoint while retaining its connection to the private RDS database.

Key Concept

VPC Networking for AWS Lambda when consuming Kinesis Data Streams and accessing public APIs
Rate this question

Topics

Stream Processing and Event Routing with Amazon Kinesis and EventBridge

More questions from this topic