Examkin

Question

Difficulty: MediumVPC Security for Developers

An application developer is implementing a Lambda function that validates user sessions. The function must query a Redis cluster running in the private subnets of a custom VPC. At the same time, the function needs to send validation logs to an external analytics provider's HTTPS endpoint on the public internet. How should the developer configure the VPC network paths to allow the Lambda function to access both the private Redis cluster and the public HTTPS endpoint?

  1. A
    Associate the Lambda function with the private subnets of the VPC. Do not provision a NAT Gateway, since Lambda functions run in a managed service environment and automatically route internet-bound API requests through the default AWS internet gateway.
  2. Place the Lambda function in the private subnets of the VPC. Create a NAT Gateway in a public subnet, and add a route in the private subnet route table that directs 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway. Ensure the Redis security group allows inbound traffic from the Lambda function's security group.Answer
  3. C
    Deploy the Lambda function outside the VPC to maintain internet access. Store the Redis connection strings in AWS Systems Manager Parameter Store, and enable the Parameter Store native automatic rotation feature to securely rotate the Redis credentials without exposing them to the internet.
  4. D
    Place the Lambda function in the private subnets of the VPC. Modify the Lambda execution role's trust policy to trust the VPC's Elastic Network Interface (ENI), allowing it to bypass security groups and route traffic directly to the external HTTPS endpoint.

Answer

Place the Lambda function in the private subnets of the VPC. Create a NAT Gateway in a public subnet, and add a route in the private subnet route table that directs 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway. Ensure the Redis security group allows inbound traffic from the Lambda function's security group.
The correct answer provides the standard, secure pattern for accessing both private VPC resources and the public internet from an AWS Lambda function. By associating the Lambda function with the private subnets, it can reach the Redis cluster. By routing outbound internet traffic (0.0.0.0/00.0.0.0/0) from the private subnets through a NAT Gateway in a public subnet, the function can safely establish HTTPS connections to the public analytics API.

Step-by-Step Solution

1
Determine private connectivity requirements
To access the Redis cluster inside the private subnets, the Lambda function must be configured with VPC integration and attached to the same VPC and private subnets.
VPC integration allows the Lambda function to access resources in private subnets via Elastic Network Interfaces (ENIs) deployed in those subnets.
2
Determine public connectivity requirements
A NAT Gateway must be provisioned in a public subnet, and the route table for the private subnets must direct all internet-bound traffic (0.0.0.0/00.0.0.0/0) to this NAT Gateway.
Lambda functions with VPC integration lose access to the public internet by default because ENIs in private subnets do not have public IP addresses.
3
Configure security group rules
Allow inbound traffic on the Redis port from the Lambda function's security group.
VPC security groups act as stateful firewalls and must explicitly permit the inbound traffic to the Redis cluster.

Key Concept

A Lambda function configured to access resources within a private VPC subnet requires a NAT Gateway or VPC Endpoint to communicate with any endpoints on the public internet.
Rate this question

Topics

VPC Security for Developers

More questions from this topic