Examkin

Question

Difficulty: MediumVPC Security for Developers

A developer is configuring an AWS Lambda function to run inside private subnets of a custom VPC. The Lambda function needs to read data from an Amazon Aurora PostgreSQL database located in another private subnet of the same VPC. Additionally, the Lambda function must retrieve database credentials from AWS Secrets Manager. To meet security requirements, all traffic must remain within the AWS network. Which two configurations must the developer implement to allow the Lambda function to connect to both the database and AWS Secrets Manager? (Select TWO.)

  1. Configure the security groups to allow outbound traffic from the Lambda function to the database, and inbound traffic to the database from the Lambda function.Answer
  2. B
    Deploy a NAT Gateway in the private subnet, and update the private subnet's route table to route traffic destined for AWS Secrets Manager through the NAT Gateway.
  3. Create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, and configure the Lambda function's security group to allow outbound traffic to the endpoint.Answer
  4. D
    Create a Gateway VPC Endpoint for AWS Secrets Manager, and associate it with the route table of the private subnets.
  5. E
    Add a statement to the AWS Secrets Manager resource-based policy to trust the VPC's CIDR block and allow the Lambda service role to assume a trust role for cross-network access.

Answer

Configure the security groups to allow outbound traffic from the Lambda function to the database (and inbound traffic to the database from the Lambda function) and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, configuring the Lambda function's security group to allow outbound traffic to the endpoint.
To secure communications between resources, security groups must explicitly allow traffic between the Lambda function and the database. Additionally, because the Lambda function resides in a private VPC subnet and must reach AWS Secrets Manager without using the public internet, an Interface VPC Endpoint must be provisioned. This places an Elastic Network Interface in the private subnet to facilitate private communication with Secrets Manager.

Step-by-Step Solution

1
Configure the security groups for the local database connection.
The Lambda function is allowed to initiate outbound connections to the database, and the database accepts inbound connections from the Lambda function on the PostgreSQL port.
Security groups act as stateful firewalls at the resource interface level to allow communication within the VPC.
2
Determine the endpoint type required to access AWS Secrets Manager privately.
Identify that an Interface VPC Endpoint (AWS PrivateLink) is needed for AWS Secrets Manager, as Gateway Endpoints are not supported for this service.
Interface VPC Endpoints allow resources inside private subnets to communicate securely with AWS services without leaving the Amazon network.
3
Establish the Interface VPC Endpoint and configure its security group.
The endpoint is created in the private subnets, and its security group is updated to allow inbound HTTPS traffic from the Lambda function's security group.
Interface endpoints use Elastic Network Interfaces (ENIs) which require security group configurations to permit incoming traffic from client resources.

Key Concept

AWS VPC private connectivity using Security Groups and Interface VPC Endpoints.
Rate this question

Topics

VPC Security for Developers

More questions from this topic