A developer is configuring an AWS Lambda function that must run inside a private subnet of a custom VPC. The Lambda function needs to retrieve database credentials from AWS Secrets Manager without the traffic traversing the public internet, and it must also call a public API endpoint on the internet to validate transactions. Which of the following network configuration steps are required to allow the Lambda function to perform these tasks? (Select TWO)
- Deploy a NAT Gateway in a public subnet, and configure the route table of the private subnet to route outbound traffic (0.0.0.0/0) through the NAT Gateway.Answer
- Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC, and associate it with the private subnet.Answer
- CDeploy a Gateway VPC Endpoint for AWS Secrets Manager and associate it with the route table of the private subnet.
- DAssign a public Elastic IP address directly to the Lambda function's Elastic Network Interface (ENI) to allow outbound access to the public API.
- EConfigure the IAM execution role of the Lambda function with a trust policy that permits access from the NAT Gateway.
Answer
To securely achieve both goals, a NAT Gateway must be deployed in a public subnet to handle internet-bound validation calls, and an Interface VPC Endpoint must be created for AWS Secrets Manager to keep the secrets retrieval traffic private.
To satisfy both requirements, the developer must configure outbound internet access and private AWS service connectivity. A NAT Gateway deployed in a public subnet allows the Lambda function in the private subnet to make outbound calls to the public API. Simultaneously, an Interface VPC Endpoint (AWS PrivateLink) is required for AWS Secrets Manager to ensure that API requests for secrets retrieval do not traverse the public internet.
Step-by-Step Solution
Key Concept
Configuring public internet egress and private AWS service access for AWS Lambda functions running inside a private subnet of a custom VPC.
Estimated Time:2m 0s