Examkin

Question

Difficulty: HardDebugging Lambda Execution and Configuration Issues

A developer is troubleshooting an AWS Lambda function that performs real-time currency conversion for a financial auditing application. The function is configured to run inside a VPC and is associated with two private subnets. It must read transaction data from an Amazon Aurora MySQL database cluster in the same VPC and fetch the latest exchange rates from a public API endpoint over the internet. While the database queries succeed, all HTTP requests to the public exchange rate API fail with connection timeout errors. Which of the following actions should the developer take to resolve this connectivity issue?

  1. Deploy a NAT Gateway in a public subnet of the VPC, and add a route in the private subnets' route table directing outbound internet traffic (0.0.0.0/0) to the NAT Gateway.Answer
  2. B
    Associate the Lambda function with public subnets of the VPC, enabling direct internet access through the VPC Internet Gateway.
  3. C
    Create an Egress-Only Internet Gateway in the VPC and add a route in the private subnets' route table directing outbound IPv4 traffic to it.
  4. D
    Increase the Lambda function's execution timeout limit to allow the execution context to persist stale database connections and avoid outbound socket timeouts.

Answer

Deploy a NAT Gateway in a public subnet of the VPC, and add a route in the private subnets' route table directing outbound internet traffic (0.0.0.0/0) to the NAT Gateway.
The correct answer is to deploy a NAT Gateway in a public subnet and add a route in the private subnets' route table. Since Lambda functions inside a VPC only receive private IP addresses from the subnets they are associated with, they cannot communicate with the internet directly. By routing outbound traffic through a NAT Gateway in a public subnet, the Lambda function can securely access the public API.

Step-by-Step Solution

1
Analyze the network configuration of the Lambda function.
The Lambda function is associated with private subnets in a VPC. It can access internal resources like the database but lacks internet connectivity.
Since Lambda functions do not receive public IP addresses, they cannot communicate directly with the internet even if associated with a public subnet.
2
Identify the resource needed to route private subnet traffic to the internet.
A NAT Gateway must be deployed in a public subnet of the VPC.
A NAT Gateway translates private IP addresses to a public IP to enable outbound internet connectivity for private resources.
3
Configure routing for the private subnets.
Add a route for 0.0.0.0/0 pointing to the NAT Gateway in the private subnets' route table.
This directs all non-VPC internet-bound traffic from the private subnets through the NAT Gateway.

Key Concept

VPC Networking for AWS Lambda Functions
Estimated Time:2m 0s
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic