Examkin

Question

Difficulty: MediumServerless Development with AWS Lambda

A team of developers is deploying a backend processing application. An AWS Lambda function is configured to run inside a private VPC subnet to securely query an Amazon RDS PostgreSQL database located in another private subnet. The function must also download configuration files from Amazon S3 and make HTTP POST requests to an external, third-party payment processing API on the public internet. Which network configuration should the developer implement to enable these connections while minimizing data transfer costs and maintaining a secure architecture?

  1. Deploy the Lambda function in the private subnets. Create a Gateway VPC Endpoint for Amazon S3, and configure a NAT Gateway in a public subnet to route outbound traffic to the public internet.Answer
  2. B
    Deploy the Lambda function in the private subnets. Create an Internet Gateway in the VPC and associate a public IP address with the Lambda function to allow direct access to the public API.
  3. C
    Deploy the Lambda function in a public subnet and enable public IP assignment. Configure an Interface VPC Endpoint for Amazon S3 to handle object retrieval.
  4. D
    Deploy the Lambda function in the private subnets. Configure an Interface VPC Endpoint for Amazon S3, and create a VPC peering connection to route external API traffic through an on-premises network.

Answer

Deploy the Lambda function in the private subnets, configure a Gateway VPC Endpoint for Amazon S3, and deploy a NAT Gateway in a public subnet to route outbound public internet traffic.
Deploying the Lambda function in private subnets allows it to access the private RDS database securely. Using a Gateway VPC Endpoint for S3 is a cost-effective choice since Gateway Endpoints do not incur hourly or data processing charges, unlike Interface Endpoints. A NAT Gateway deployed in a public subnet is required to route outbound public internet traffic for the Lambda function in the private subnet.

Step-by-Step Solution

1
Analyze the destination targets and security requirements.
The RDS database is private (requires private subnet association), S3 is an AWS service (can use a VPC endpoint), and the payment API is on the public internet (requires a NAT Gateway or NAT instance for private resources).
To determine the networking components needed for the VPC.
2
Determine the most cost-effective and secure way to access Amazon S3.
A Gateway VPC Endpoint is free and routes traffic directly to S3 without going through the NAT Gateway, saving data processing fees.
To minimize data transfer costs as requested.
3
Configure the route table for the private subnets where the Lambda function resides.
Add a route directing 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway in the public subnet.
To enable outbound internet access to the payment gateway API.

Key Concept

VPC networking for AWS Lambda, including NAT Gateway and VPC Endpoints.
Estimated Time:1m 30s
Rate this question

Topics

Serverless Development with AWS Lambda

More questions from this topic