Examkin

Question

Difficulty: EasyDebugging Lambda Execution and Configuration Issues

An order processing service runs on AWS Lambda. To comply with security guidelines, this function is attached to private subnets within a VPC to query an Amazon Aurora database. As part of its execution, the function must also call an external payment gateway API over the internet. Although the database queries succeed, all external API calls timeout. What configuration change is required to allow the function to connect to the external API?

  1. A
    Relocate the Lambda function configuration from the private subnets to the public subnets of the VPC to grant it a public IP address.
  2. Create a NAT gateway in a public subnet of the VPC and configure a route for outbound internet traffic in the private subnet's route table.Answer
  3. C
    Extend the execution timeout of the Lambda function to allow more time for the external API requests to complete.
  4. D
    Update the Lambda function's IAM execution role trust policy to allow the VPC endpoints to assume the role.

Answer

Create a NAT gateway in a public subnet of the VPC and configure a route for outbound internet traffic in the private subnet's route table.
The correct action is to create a NAT gateway in a public subnet and configure a route in the private subnet's route table. When a Lambda function is configured to run inside a VPC, it does not have direct internet access. To access an external API, outbound internet traffic must be routed through a NAT gateway located in a public subnet.

Step-by-Step Solution

1
Analyze the networking configuration of the Lambda function.
The Lambda function is running in private subnets of a VPC, allowing it to connect to the internal database but blocking direct internet access.
By default, a Lambda function inside a VPC has no internet access.
2
Identify the destination of the failed network request.
The function is attempting to reach an external payment gateway API over the public internet.
Knowing the target is internet-based determines whether we need internet routing (NAT gateway) or a VPC endpoint.
3
Select the correct AWS network component to bridge the private VPC subnets to the public internet.
A NAT gateway placed in a public subnet with appropriate route table entries allows the private subnets to reach the internet.
This establishes outbound-only internet connectivity for resources in private subnets.

Key Concept

VPC Networking for AWS Lambda
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic