Examkin

Question

Difficulty: MediumDebugging Lambda Execution and Configuration Issues

A developer is implementing an AWS Lambda function that processes customer feedback and calls a third-party translation API over the internet. The Lambda function is configured to run inside a custom VPC and is associated with two public subnets. The VPC has an Internet Gateway, and the route table for the public subnets contains a route pointing 0.0.0.0/0 to the Internet Gateway. During testing, the Lambda function fails to connect to the translation API and terminates after reaching its maximum timeout limit. What configuration change should the developer make to resolve this connection issue?

  1. A
    Enable the auto-assign public IP setting in the VPC subnets associated with the Lambda function to allow the function's network interfaces to receive public IP addresses.
  2. Configure the Lambda function to run in private subnets, and route internet-bound traffic through a NAT Gateway.Answer
  3. C
    Increase the execution timeout limit of the Lambda function and set the reserved concurrency to 1 to prevent connection pool exhaustion.
  4. D
    Attach an Internet Gateway directly to the Lambda function's network interface and update the security group rules to allow outbound HTTP/HTTPS traffic.

Answer

Configure the Lambda function to run in private subnets, and route internet-bound traffic through a NAT Gateway.
The correct answer is to configure the Lambda function to run in private subnets and route internet-bound traffic through a NAT Gateway. This is because AWS Lambda functions configured within a VPC do not receive public IP addresses, even when associated with public subnets. As a result, they cannot route traffic directly to an Internet Gateway. Placing the Lambda function in private subnets and routing internet-bound traffic through a NAT Gateway (which has a public IP address) enables the function to reach external web APIs.

Step-by-Step Solution

1
Analyze the network configuration of the Lambda function.
The Lambda function is placed in public subnets with a route to an Internet Gateway.
To understand why the network connection to the public internet API is failing.
2
Determine how Lambda ENIs handle public routing.
Lambda ENIs are only assigned private IP addresses, regardless of whether they are deployed in a public or private subnet.
This explains why the Lambda function cannot communicate directly with the Internet Gateway (which requires a public IP address on the source interface).
3
Apply the standard serverless networking pattern for outbound internet access.
Move the Lambda function to private subnets and direct outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet.
The NAT Gateway performs network address translation using its elastic IP address, allowing the Lambda function to establish outbound connections to the internet.

Key Concept

AWS Lambda VPC networking and outbound internet access constraints
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic