Examkin

Question

Difficulty: MediumVPC Security for Developers

An asynchronous processing system utilizes an AWS Lambda function to retrieve messages from an Amazon SQS queue and perform updates on an Amazon Aurora PostgreSQL database. The database is hosted in private subnets within a custom VPC. To connect to the database, the Lambda function is associated with the same private subnets. However, the Lambda function fails to retrieve any messages from the queue and times out during execution. How should the network and endpoint configuration be adjusted to allow the function to securely poll the SQS queue?

  1. Establish an Interface VPC endpoint for Amazon SQS within the private subnets, enabling private DNS hostnames for the VPC endpoint to route requests internally.Answer
  2. B
    Reconfigure the Lambda function to reside in the public subnets of the VPC so that it can route traffic directly to the public SQS endpoint using the Internet Gateway.
  3. C
    Migrate the SQS connection metadata into AWS Secrets Manager with active secret rotation enabled, allowing the function to dynamically fetch the endpoint credentials.
  4. D
    Update the trust relationship policy of the Lambda execution role to include the Amazon SQS service principal, enabling the queue to push messages to the function.

Answer

Establish an Interface VPC endpoint for Amazon SQS within the private subnets, enabling private DNS hostnames for the VPC endpoint to route requests internally.
Establishing an Interface VPC endpoint for Amazon SQS inside the private VPC subnets allows the Lambda function to securely and privately access SQS over the AWS internal network. Activating private DNS hostnames ensures that the standard SQS DNS hostname automatically resolves to the private IP addresses of the endpoint network interfaces.

Step-by-Step Solution

1
Analyze the network configuration of the Lambda function.
The Lambda function is placed in a private VPC subnet to access the private Aurora database.
By placing Lambda in a VPC subnet, it loses its default internet connectivity and can only access resources inside the VPC or via VPC gateways/endpoints.
2
Identify the destination endpoint requirements.
The Lambda function needs to communicate with Amazon SQS, which is a public AWS service.
Since the function is in a private subnet with no path to the public internet, it cannot resolve or reach the public SQS endpoint directly.
3
Determine the secure, private solution for AWS service integration.
Create an Interface VPC endpoint (powered by AWS PrivateLink) for SQS in the VPC and enable Private DNS.
This places elastic network interfaces (ENIs) inside the private subnets, allowing the Lambda function to route SQS API calls entirely within the AWS network.

Key Concept

VPC Endpoint Connectivity for Serverless Resources
Estimated Time:1m 30s
Rate this question

Topics

VPC Security for Developers

More questions from this topic