Examkin

Question

Difficulty: EasyVPC Security for Developers

A developer is deploying an AWS Lambda function that must connect to an Amazon ElastiCache (Redis OSS) cluster. The ElastiCache cluster is running in the private subnets of a custom VPC. The Lambda function does not need access to the public internet or external APIs. Which of the following configuration steps must the developer perform to establish secure network connectivity between the Lambda function and the ElastiCache cluster? (Select TWO.)

  1. Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group.Answer
  2. Configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.Answer
  3. C
    Provision a NAT Gateway in the private subnet and update the subnet route tables to route ElastiCache traffic through it.
  4. D
    Modify the Lambda function's IAM execution role trust policy to allow the ElastiCache service to assume the role.
  5. E
    Store the ElastiCache security group ID in AWS Secrets Manager to automatically authorize traffic and bypass security group checks.

Answer

Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group, and configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.
To allow the Lambda function to reach the ElastiCache cluster, the Lambda function must first be attached to the same VPC. This is done by configuring VPC access on the Lambda function, which deploys ENIs in the specified private subnets. Second, since security groups are stateful and deny all inbound traffic by default, the ElastiCache security group must be updated to allow inbound TCP traffic on the Redis port from the security group associated with the Lambda function.

Step-by-Step Solution

1
Enable VPC access for the Lambda function.
The Lambda function is assigned Elastic Network Interfaces (ENIs) in the specified private subnets, enabling it to reach resources inside the VPC.
By default, Lambda functions run in an AWS-managed network that cannot directly communicate with private subnets inside a custom VPC.
2
Configure the database security group.
The stateful firewall allows incoming network connections from the Lambda function's security group on the specific Redis database port.
Security groups deny all inbound traffic by default, so you must explicitly authorize access from the client's security group.

Key Concept

To enable secure communication between an AWS Lambda function and an internal VPC resource (like ElastiCache), the Lambda function must be associated with the private subnets of the VPC, and the destination security group must explicitly allow inbound traffic from the Lambda function's security group. Internal VPC communication uses local routes and does not require a NAT Gateway.
Rate this question

Topics

VPC Security for Developers

More questions from this topic