Examkin

Question

Difficulty: EasyDebugging Lambda Execution and Configuration Issues

An application uses an AWS Lambda function associated with private subnets of a VPC to perform write operations on an Amazon RDS PostgreSQL database. The function also needs to write tracking data to an Amazon DynamoDB table, but the write operations to DynamoDB are failing with connection timeout errors. Which two actions should a developer take to resolve this connectivity issue? (Select TWO.)

  1. Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route table used by the Lambda function's subnets.Answer
  2. Deploy a NAT Gateway in a public subnet of the VPC, and add a route pointing to it in the private subnet's route table.Answer
  3. C
    Configure the Lambda function to use the public subnets of the VPC and enable the public IP assignment setting on the function configuration.
  4. D
    Attach an Internet Gateway directly to the private subnets' route table with a destination route of 0.0.0.0/00.0.0.0/0.
  5. E
    Update the Lambda function's IAM execution role to include the DynamoDB policy with the AmazonDynamoDBFullAccess permission.

Answer

To resolve the connection timeout issue, the developer must either create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet's route table, or deploy a NAT Gateway in a public subnet and route the private subnet's internet-bound traffic through it.
The Lambda function is failing to reach the public DynamoDB endpoint because it is running inside private subnets of a VPC without access to public endpoints. The two correct options resolve this: one by establishing a Gateway VPC Endpoint that routes DynamoDB traffic internally, and the other by establishing a NAT Gateway in a public subnet to allow outbound internet access for resources in private subnets.

Step-by-Step Solution

1
Analyze the error symptom.
The Lambda function is experiencing connection timeout errors, indicating a network routing block rather than an IAM permission (AccessDenied) block.
Correctly identifying the nature of the error prevents unnecessary IAM configuration changes and focuses troubleshooting on VPC routing.
2
Evaluate the current network configuration.
The Lambda function resides in private VPC subnets to access RDS. Private subnets do not have direct access to the public internet where DynamoDB resides.
Understanding the isolation of private subnets explains why traffic cannot reach DynamoDB without a gateway helper.
3
Select valid network routing solutions.
A Gateway VPC Endpoint or a NAT Gateway allows private subnet traffic to reach DynamoDB.
A Gateway VPC Endpoint routes traffic to DynamoDB internally within the AWS network, while a NAT Gateway routes traffic to public endpoints via a public subnet.

Key Concept

VPC Networking for AWS Lambda Functions
Estimated Time:1m 30s
Rate this question

Topics

Debugging Lambda Execution and Configuration Issues

More questions from this topic