Examkin

Question

Difficulty: HardServerless Development with AWS Lambda

An image processing application uses an Amazon SQS queue to trigger an AWS Lambda function that processes batch metadata and fetches external assets via HTTPS. The Lambda function is placed in a private VPC subnet to securely query an Amazon RDS PostgreSQL DB instance in the same VPC. During testing, the developer observes two issues: the Lambda function fails to connect to the external assets API, and several messages from the SQS queue are being processed multiple times, causing duplicate entries in the database. The Lambda function's timeout is set to 55 minutes. Which two actions should the developer take to resolve these issues? (Select two.)

  1. Configure a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table pointing 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway.Answer
  2. Increase the visibility timeout of the Amazon SQS queue to at least 3030 minutes, matching the recommended ratio of 66 times the Lambda function's timeout.Answer
  3. C
    Assign a public IPv4 address to the Lambda function configuration and associate an Internet Gateway directly with the private subnet's route table.
  4. D
    Increase the Lambda function's timeout value to 3030 minutes to allow the function more time to process the batch before the queue retrieves the message again.
  5. E
    Enable Provisioned Concurrency for the Lambda function and set the execution timeout to match the default SQS visibility timeout of 3030 seconds.

Answer

Configure a NAT Gateway in a public subnet of the VPC with a route for 0.0.0.0/00.0.0.0/0 in the private subnet's route table, and increase the SQS queue's visibility timeout to at least 3030 minutes.
Configuring a NAT Gateway in a public subnet and updating the private subnet's route table ensures that the Lambda function can route outbound HTTPS requests to the internet. Concurrently, increasing the SQS visibility timeout to at least 66 times the Lambda timeout (3030 minutes for a 55-minute Lambda timeout) prevents SQS from releasing messages back to the queue while the Lambda function is still processing them, thereby preventing duplicate processing.

Step-by-Step Solution

1
Analyze the network failure of the Lambda function when accessing the external HTTP API.
Identify that because the Lambda function is placed in a private subnet, it lacks internet access without an outbound gateway.
Lambda functions in private subnets require a NAT Gateway or NAT instance in a public subnet to route outbound internet traffic.
2
Resolve the VPC internet connectivity issue.
Create a NAT Gateway in a public subnet, and configure a route for 0.0.0.0/00.0.0.0/0 pointing to this NAT Gateway in the private subnet's route table.
This establishes internet egress for resources in the private subnet while keeping them protected from inbound public traffic.
3
Analyze the duplicate SQS message processing issue.
Identify that the Lambda function's timeout of 55 minutes is causing messages to exceed the default SQS visibility timeout (which defaults to 3030 seconds) before completion.
When a message processing time exceeds the visibility timeout, the message becomes visible to other consumers, causing duplicates.
4
Adjust the SQS visibility timeout to align with AWS Lambda integration best practices.
Increase the visibility timeout of the SQS queue to 3030 minutes, which is 66 times the Lambda function's timeout.
AWS recommends setting the SQS visibility timeout to at least 66 times the Lambda function's timeout to prevent duplicate deliveries and handle retries.

Key Concept

Configuring private subnet internet access for AWS Lambda and aligning SQS visibility timeouts with Lambda function execution limits.
Estimated Time:2m 0s
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic