Examkin

Question

Difficulty: Very hardServerless Development with AWS Lambda

A developer is configuring an AWS Lambda function inside a private subnet of a custom VPC to process messages from an Amazon SQS queue. The Lambda function must read database credentials from AWS Secrets Manager and write the processed results to an Amazon DynamoDB table. To satisfy security requirements, the VPC has no internet access, and all traffic must remain within the AWS network.

The developer creates a Gateway VPC endpoint for DynamoDB and an Interface VPC endpoint for Secrets Manager. However, when the Lambda function runs, it fails with connection timeout errors when attempting to access both DynamoDB and Secrets Manager.

Which combination of actions will resolve these connection timeouts? (Select two.)

  1. Update the route table associated with the Lambda function's private subnet to include a route that targets the DynamoDB Gateway VPC endpoint for the DynamoDB prefix list.Answer
  2. Modify the security group associated with the Secrets Manager Interface VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group associated with the Lambda function.Answer
  3. C
    Configure the security group associated with the Lambda function to allow inbound HTTPS traffic on port 443 from the Secrets Manager Interface VPC endpoint.
  4. D
    Add a route to the route table of the Lambda function's private subnet that routes all traffic to the Secrets Manager Interface VPC endpoint as the target.
  5. E
    Increase the visibility timeout of the SQS queue to be greater than the Lambda function's timeout, and configure the Lambda function's concurrency limit to match the SQS queue's batch size.

Answer

Update the route table associated with the Lambda function's private subnet to include a route that targets the DynamoDB Gateway VPC endpoint for the DynamoDB prefix list, and modify the security group associated with the Secrets Manager Interface VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group associated with the Lambda function.
To resolve connection timeouts inside a private VPC with no internet access, the developer must properly configure the networking and security rules for the VPC endpoints. For the DynamoDB Gateway endpoint, a route must be added to the subnet's route table targeting the DynamoDB prefix list. For the Secrets Manager Interface endpoint, which uses ENIs, the endpoint's security group must be configured to accept inbound HTTPS (port 443) connections from the Lambda function's security group.

Step-by-Step Solution

1
Identify the cause of the DynamoDB timeout.
Determine that DynamoDB is accessed via a Gateway VPC endpoint.
Gateway endpoints require explicit routes in the subnet's route table to direct traffic to the service.
2
Resolve the DynamoDB configuration issue.
Add a route in the private subnet's route table pointing to the DynamoDB prefix list with the Gateway endpoint ID as the target.
This enables the VPC router to forward DynamoDB-bound traffic through the Gateway endpoint.
3
Identify the cause of the Secrets Manager timeout.
Determine that Secrets Manager is accessed via an Interface VPC endpoint.
Interface endpoints use Elastic Network Interfaces (ENIs) with security groups, which require appropriate inbound permissions.
4
Resolve the Secrets Manager configuration issue.
Configure the security group of the Secrets Manager Interface endpoint to allow inbound HTTPS (port 443) traffic from the security group of the Lambda function.
This allows the inbound connection from the Lambda function's ENI to the endpoint's ENI.

Key Concept

AWS Lambda VPC networking using Gateway and Interface VPC endpoints
Estimated Time:3m 0s
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic