Examkin

Question

Difficulty: HardVPC Security for Developers

A developer is deploying an AWS Lambda function inside the private subnets of a custom VPC to process internal company data. The function needs to retrieve non-sensitive application settings, such as feature flags and external API endpoint URLs, without traversing the public internet. The architecture must minimize operational costs and must not use NAT Gateways or Internet Gateways. Which configuration should the developer implement to meet these requirements?

  1. A
    Store the configuration settings in AWS Secrets Manager, create an interface VPC endpoint for Secrets Manager in the VPC, and configure the security groups to allow HTTPS traffic between the Lambda function and the Secrets Manager VPC endpoint.
  2. Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, create an interface VPC endpoint for Systems Manager in the VPC, and configure the security groups to allow HTTPS traffic between the Lambda function and the Systems Manager VPC endpoint.Answer
  3. C
    Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, associate the Lambda function with the private subnets of the VPC, and rely on the default AWS Lambda execution role's permissions to bypass network routing and access Parameter Store directly without any VPC endpoints.
  4. D
    Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, create an interface VPC endpoint for Systems Manager in the VPC, and modify the IAM role trust policy of the Lambda execution role to allow the Systems Manager service principal to assume the role.

Answer

Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, create an interface VPC endpoint for Systems Manager in the VPC, and configure the security groups to allow HTTPS traffic between the Lambda function and the Systems Manager VPC endpoint.
The correct option correctly identifies the need for Systems Manager Parameter Store to handle non-sensitive configuration settings cost-effectively (as standard parameters have no associated cost, unlike Secrets Manager). It also correctly configures an interface VPC endpoint to enable private communication between the Lambda function in the private subnet and the Systems Manager service, bypassing the need for a NAT Gateway or public internet routing.

Step-by-Step Solution

1
Analyze cost and data sensitivity requirements.
Identify that the settings are non-sensitive and the architecture must minimize operational costs, leading to the selection of AWS Systems Manager Parameter Store standard parameters, which are free of charge, over AWS Secrets Manager.
AWS Secrets Manager charges a flat rate per secret per month, which increases operational costs unnecessarily for non-sensitive configuration settings.
2
Analyze network path constraints.
Recognize that because the Lambda function is attached to a private subnet in a VPC with no NAT Gateway or Internet Gateway, it lacks a default route to public AWS endpoints over the internet.
AWS resources inside a custom VPC private subnet cannot resolve or connect to public service endpoints like Parameter Store without an explicit routing path.
3
Select the private connectivity mechanism.
Establish an interface VPC endpoint (AWS PrivateLink) specifically for Systems Manager (com.amazonaws.region.ssm) in the custom VPC.
An interface VPC endpoint places elastic network interfaces (ENIs) with private IP addresses in the subnets, enabling secure and private connections to AWS services.
4
Configure the security groups.
Allow outbound HTTPS (TCP port 443) from the Lambda function's security group to the interface VPC endpoint's security group, and inbound HTTPS on the endpoint's security group from the Lambda function.
Security groups are stateful and must explicitly allow the necessary traffic to complete the PrivateLink network connection.

Key Concept

Configuring private access to AWS services via Interface VPC Endpoints (AWS PrivateLink) for resource-constrained architectures.
Estimated Time:2m 0s
Rate this question

Topics

VPC Security for Developers

More questions from this topic