Examkin

Question

Difficulty: MediumDebugging Lambda Execution and Configuration Issues

A developer is troubleshooting an AWS Lambda function that processes customer orders. The function is configured to connect to an Amazon RDS PostgreSQL database in a private subnet of a custom VPC. The function also needs to call a third-party payment provider's public API endpoint over the internet. The developer configured the Lambda function to run in the public subnets of the VPC and associated it with a security group that allows all outbound traffic. During execution, the function successfully queries the database but times out when attempting to reach the payment provider's API.

Which of the following actions will resolve this connectivity issue?

  1. Associate the Lambda function with the private subnets of the VPC, deploy a NAT Gateway in a public subnet, and route internet-bound traffic from the private subnets through the NAT Gateway.Answer
  2. B
    Enable the 'Assign Public IP' setting in the Lambda function's VPC configuration to allow the function to route traffic directly through the VPC's Internet Gateway.
  3. C
    Add a route to the public subnet's route table with destination 0.0.0.0/0 targeting the Internet Gateway, and attach an Elastic IP address to the Lambda function's elastic network interfaces (ENIs).
  4. D
    Increase the Lambda function's execution timeout to 15 minutes and allocate more memory to allow the connection pool to establish a secure connection over the VPC internet route.

Answer

Associate the Lambda function with the private subnets of the VPC, deploy a NAT Gateway in a public subnet, and route internet-bound traffic from the private subnets through the NAT Gateway.
The correct solution is to associate the Lambda function with the private subnets of the VPC, deploy a NAT Gateway in a public subnet, and route internet-bound traffic from the private subnets through the NAT Gateway. AWS Lambda functions associated with a VPC do not receive public IP addresses. Even if placed in a public subnet, they cannot route traffic directly to the Internet Gateway. Moving the function to private subnets and routing outbound traffic through a NAT Gateway resolves this limitation.

Step-by-Step Solution

1
Analyze the network configuration of the Lambda function.
Identify that the Lambda function is placed in public subnets but lacks public IP addresses, preventing direct internet access.
Lambda functions in a VPC do not get public IPs, meaning they cannot use an Internet Gateway directly.
2
Reconfigure the Lambda subnets.
Move the Lambda function configuration to private subnets of the VPC.
This is the standard architectural pattern for resource isolation and enabling NAT-based outbound routes.
3
Deploy and configure a NAT Gateway.
Set up a NAT Gateway in a public subnet and update the private subnet's route table to direct 0.0.0.0/0 traffic to the NAT Gateway.
This enables resources in the private subnets (including the Lambda function) to securely route outbound requests to the public API.

Key Concept

AWS Lambda VPC networking and outbound internet access
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic