Security

390 questions

All types390 Multiple choice195 Multiple select195

A developer is deploying a microservice as an Amazon ECS task on AWS Fargate. The microservice needs to read configuration files from an Amazon S3 bucket. The developer creates an IAM role with the necessary S3 permissions and associates it with the ECS Task Definition as the `taskRoleArn`. However, when the container starts, the application logs show an error indicating that the task is unable to retrieve temporary credentials to access Amazon S3.

The trust policy currently configured on the IAM role is as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the IAM role configuration will resolve this issue?

Add the `s3:GetObject` action and the S3 bucket ARN directly to the trust policy statements.

Remove the trust policy and hardcode a set of long-term AWS access keys with S3 permissions directly into the application's SDK client configuration.

Change the principal service in the trust policy to `ecs-tasks.amazonaws.com`.

Change the trust policy action to `sts:AssumeRoleWithWebIdentity` to allow container-level authentication.

Show answer & explanation

Answer: Change the principal service in the trust policy to `ecs-tasks.amazonaws.com`.

Answer

Change the principal service in the trust policy to `ecs-tasks.amazonaws.com`.

The correct action is to change the principal service in the trust policy to `ecs-tasks.amazonaws.com`. In Amazon ECS, when running tasks on Fargate or EC2, the Amazon ECS container agent makes the call to assume the IAM role defined as `taskRoleArn` on behalf of the container. The service principal representing these ECS tasks is `ecs-tasks.amazonaws.com`. Using `ecs.amazonaws.com` is incorrect because it represents the core Amazon ECS service scheduler itself (used for registering container instances or updating service status), which does not have permission to assume the task role.

Step-by-Step Solution

Identify the entity attempting to assume the IAM role.

The application is running as an Amazon ECS task.

We must verify the correct service principal required by the runtime environment.

Check the service principal specified in the trust policy.

The current trust policy specifies `ecs.amazonaws.com`.

We need to ensure that the correct service is authorized to assume the role.

Modify the service principal to match the ECS task runtime service.

Update the trust policy's Principal Service to `ecs-tasks.amazonaws.com`.

This allows the ECS task container agent to retrieve temporary security credentials for S3 access.

Key Concept

IAM Role Trust Policy Service Principals

Question 82Question →

A developer is configuring an AWS Lambda function to process events from an Amazon S3 bucket. The developer creates an IAM role named S3ProcessorRole with the necessary permissions policy to read from the S3 bucket. However, when attempting to associate the role with the Lambda function, the developer receives the following error:

An error occurred (InvalidParameterValueException) when updating the function's configuration: KMS or signature validation failed or the provided execution role cannot be assumed by Lambda.

The current trust policy configured on the S3ProcessorRole is:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following steps are required to resolve this error and enable the Lambda function to successfully read from the S3 bucket? (Select TWO.)

Select all that apply

Update the trust policy of S3ProcessorRole to specify "Service": "lambda.amazonaws.com" instead of "Service": "ec2.amazonaws.com".

Attach an identity-based permissions policy to S3ProcessorRole that allows the s3:GetObject action on the target S3 bucket resource.

Add the sts:AssumeRole action to the identity-based permissions policy attached to S3ProcessorRole.

Add the s3:GetObject action directly to the trust policy of S3ProcessorRole under the Action list.

Configure the Lambda function to initialize the Amazon S3 client by passing hardcoded AWS access keys of an administrator IAM user.

Show answer & explanation

Answer: Update the trust policy of S3ProcessorRole to specify "Service": "lambda.amazonaws.com" instead of "Service": "ec2.amazonaws.com".; Attach an identity-based permissions policy to S3ProcessorRole that allows the s3:GetObject action on the target S3 bucket resource.

Answer

Update the trust policy of the IAM role to use the 'lambda.amazonaws.com' service principal and attach an identity-based permissions policy allowing 's3:GetObject' on the S3 bucket.

To resolve the error, the Lambda service must be allowed to assume the IAM role. This is done by specifying the Lambda service principal ('lambda.amazonaws.com') in the trust policy's Principal block. Additionally, to allow the Lambda function to read from the S3 bucket once the role is assumed, the role must have an identity-based permission policy that grants the 's3:GetObject' permission on the target S3 bucket.

Step-by-Step Solution

Analyze the error message showing the execution role cannot be assumed by Lambda.

Determine that the Lambda service principal is missing from the trust policy.

An execution role requires a trust relationship that allows the service (Lambda) to assume it.

Update the trust policy of the S3ProcessorRole.

Modify the service principal to 'lambda.amazonaws.com' with the action 'sts:AssumeRole'.

This enables the Lambda service to assume the execution role when invoking the function.

Define the permissions required by the Lambda function code.

Attach an identity-based policy allowing 's3:GetObject' on the target S3 bucket resource.

Once assumed, the role needs permissions to perform the actual S3 read operation.

Key Concept

IAM trust policies vs permissions policies for service execution roles

Question 83Question →

A developer is attempting to deploy an AWS Lambda function that reads data from an Amazon DynamoDB table. The developer has created an IAM role named `DynamoDbReaderRole` with a permissions policy that grants `dynamodb:GetItem` and `dynamodb:Query` access. However, when the developer tries to deploy the Lambda function and associate it with `DynamoDbReaderRole` using the AWS CLI, the deployment fails with an error indicating that Lambda is not authorized to assume the role, and that the developer is not authorized to perform `iam:PassRole` on the resource.

Which TWO actions must the developer take to successfully deploy the Lambda function? (Select TWO.)

Select all that apply

Modify the trust policy of `DynamoDbReaderRole` to allow the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action.

Attach an IAM policy to the developer's IAM user or role that allows the `iam:PassRole` action on `DynamoDbReaderRole`.

Attach an IAM policy to the developer's IAM user or role that allows the `sts:AssumeRole` action on `DynamoDbReaderRole`.

Modify the trust policy of `DynamoDbReaderRole` to allow the developer's IAM user ARN to perform the `sts:AssumeRole` action.

Embed the AWS access keys of an IAM user with full DynamoDB permissions directly into the Lambda function's environment variables and remove the role association.

Show answer & explanation

Answer: Modify the trust policy of `DynamoDbReaderRole` to allow the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action.; Attach an IAM policy to the developer's IAM user or role that allows the `iam:PassRole` action on `DynamoDbReaderRole`.

Answer

To successfully deploy the Lambda function, the developer must modify the trust policy of the role to allow the Lambda service principal to assume it, and attach an IAM policy to their own user or role that grants permission to pass the role.

The correct configuration requires two actions. First, the trust policy of the execution role must trust the `lambda.amazonaws.com` service principal so that AWS Lambda can assume the role when running the function. Second, the developer's IAM identity must have permission to perform `iam:PassRole` on the execution role, which authorizes the developer to associate this specific role with the Lambda service during deployment.

Step-by-Step Solution

Analyze the two error messages: one related to the service not being authorized to assume the role, and the other related to the user not being authorized to perform `iam:PassRole`.

Identify that the Lambda service principal must be allowed to assume the role, and the developer's user identity must have permission to pass the role.

This isolates the two distinct IAM configurations required: the trust policy on the role and the permissions policy on the developer.

Configure the trust relationship for the execution role.

The trust policy of `DynamoDbReaderRole` is updated to allow `sts:AssumeRole` for `lambda.amazonaws.com`.

This allows the Lambda service to assume the execution role when invoking the function.

Grant the developer authorization to assign the role to the Lambda function.

An IAM policy with `iam:PassRole` on the role's ARN is attached to the developer's IAM user or group.

This allows the developer to pass the role to AWS Lambda during the creation or update of the function.

Key Concept

The combination of the service trust policy (which defines who can assume the role) and the `iam:PassRole` permission (which authorizes a user to pass the role to a service) is required for successful service role association.

Estimated Time:1m 30s

Question 84Question →

A developer is configuring an Amazon ECS task definition to run a containerized application on AWS Fargate. The application code needs to query an Amazon DynamoDB table. Additionally, the ECS container agent must pull the container image from Amazon ECR and send container logs to Amazon CloudWatch Logs. Which configuration of IAM roles meets these requirements with the least privilege?

Specify an IAM role with permissions to query DynamoDB as the taskRoleArn (Task Role), and specify a separate IAM role with permissions to pull from ECR and write to CloudWatch Logs as the executionRoleArn (Task Execution Role).

Specify an IAM role with permissions to query DynamoDB, pull from ECR, and write to CloudWatch Logs as the executionRoleArn (Task Execution Role), and leave the taskRoleArn (Task Role) empty.

Specify an IAM role with permissions to pull from ECR and write to CloudWatch Logs as the executionRoleArn (Task Execution Role), and hardcode the access key ID and secret access key of an IAM user with DynamoDB permissions inside the application code.

Specify an IAM role with permissions to query DynamoDB as the taskRoleArn (Task Role), but configure the trust policy of this role to allow the ecs.amazonaws.com service principal to assume the role.

Show answer & explanation

Answer: Specify an IAM role with permissions to query DynamoDB as the taskRoleArn (Task Role), and specify a separate IAM role with permissions to pull from ECR and write to CloudWatch Logs as the executionRoleArn (Task Execution Role).

Answer

The correct configuration uses the Task Role (taskRoleArn) to grant the application code running inside the container permissions to access DynamoDB. Meanwhile, the Task Execution Role (executionRoleArn) grants the ECS container agent permissions to pull the container image from ECR and send logs to CloudWatch. This follows the principle of least privilege and separates infrastructure permissions from application permissions.

Step-by-Step Solution

Identify the credentials needed by the application itself.

The application code queries DynamoDB, which requires read/query permissions on the DynamoDB table.

Application-level permissions must be associated with the ECS Task Role (taskRoleArn).

Identify the credentials needed by the ECS container agent.

The agent needs to pull the container image from ECR and create/write log streams in CloudWatch Logs.

Infrastructure/agent-level permissions must be associated with the ECS Task Execution Role (executionRoleArn).

Configure the trust relationship for the roles.

Both roles must have a trust policy allowing the ecs-tasks.amazonaws.com service principal to assume them.

This allows the ECS service to pass these temporary credentials to the tasks and the agent.

Key Concept

Separation of concerns between ECS Task Role and ECS Task Execution Role

Estimated Time:1m 30s

Question 85Question →

A company is building a machine-to-machine (M2M) integration that allows an on-premises backend service to programmatically upload raw telemetry data to a private Amazon API Gateway endpoint. The developer needs to secure the API Gateway endpoint using Amazon Cognito. The backend service must authenticate using its credentials, obtain an access token, and use this token to authorize its API requests.

Which solution meets these requirements with the least operational overhead?

Configure an Amazon Cognito User Pool with a resource server and a user pool client configured with the client credentials grant. In Amazon API Gateway, configure a Cognito User Pool authorizer and set the OAuth scopes on the API method.

Configure an Amazon Cognito Identity Pool to federate the on-premises backend service. Use the developer-authenticated identities feature to generate temporary AWS credentials, and configure IAM authorization on the API Gateway endpoint.

Configure an Amazon Cognito User Pool with a resource server and a user pool client configured with the client credentials grant. In Amazon API Gateway, write a custom Lambda authorizer to decode, verify, and validate the signature of the Cognito JWT access token.

Configure an Amazon Cognito User Pool and create a user account for the on-premises service. Use the USER_PASSWORD_AUTH authentication flow to retrieve an ID token, and use an API Gateway Cognito User Pool authorizer to secure the method.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with a resource server and a user pool client configured with the client credentials grant. In Amazon API Gateway, configure a Cognito User Pool authorizer and set the OAuth scopes on the API method.

Answer

The correct solution uses an Amazon Cognito User Pool with the client credentials grant to support machine-to-machine authentication. By defining a resource server with custom scopes, the backend service can retrieve a JWT access token. Securing the API Gateway is natively achieved by configuring a built-in Cognito User Pool authorizer and applying the custom OAuth scopes to the API method, which eliminates the need to write custom Lambda code or manage complex developer-authenticated identity flows.

Step-by-Step Solution

Set up a Cognito User Pool with a client credentials flow

Created a User Pool, defined a resource server with custom scopes, and enabled the client credentials grant on the app client.

This allows the on-premises machine/service to authenticate programmatically using its client ID and client secret, receiving a standard OAuth 2.0 JSON Web Token (JWT) access token containing the scopes.

Configure API Gateway Authorization

Created an API Gateway Cognito User Pool authorizer and associated it with the target API resource methods, specifying the custom OAuth scopes required to invoke them.

This offloads token validation to API Gateway's native authorizer, ensuring that only requests with a valid token containing the correct scopes are allowed to pass through to the backend.

Key Concept

Using Amazon Cognito User Pools for OAuth 2.0 client credentials grant and securing API Gateway with a built-in Cognito authorizer.

Question 86Question →

A developer is designing a mobile multiplayer game. The game client needs to read and write player progress data directly to an Amazon DynamoDB table without routing requests through a custom backend API, to minimize latency and server costs. Players must authenticate using an Amazon Cognito User Pool. The security design requires that players can only access DynamoDB items where the partition key matches their unique Cognito user identifier. Which solution meets these requirements with the least operational overhead?

Configure a Amazon Cognito User Pool with a Post-Authentication AWS Lambda trigger. Have the Lambda function call the AWS Security Token Service (STS) to assume an IAM role with DynamoDB access, and inject these temporary credentials into the Cognito ID token claims returned to the mobile client.

Configure an Amazon Cognito Identity Pool and set the Amazon Cognito User Pool as the authentication provider. Associate an IAM role with the authenticated users that permits DynamoDB access, using the dynamodb:LeadingKeys condition key set to ${cognito-identity.amazonaws.com:sub} in the IAM policy.

Configure an Amazon API Gateway REST API with a Cognito User Pool Authorizer to proxy DynamoDB requests. Secure the DynamoDB table using an IAM resource policy that restricts access based on the cognito:username claim passed in the API Gateway request context.

Create a Cognito User Pool and assign an IAM role directly to a User Pool group. Have the mobile client authenticate against the User Pool and use the User Pool ID token directly to initialize the DynamoDB client, which automatically restricts access based on the group role.

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool and set the Amazon Cognito User Pool as the authentication provider. Associate an IAM role with the authenticated users that permits DynamoDB access, using the dynamodb:LeadingKeys condition key set to ${cognito-identity.amazonaws.com:sub} in the IAM policy.

Answer

Configure an Amazon Cognito Identity Pool, configure the User Pool as the identity provider, and apply an IAM policy with a dynamodb:LeadingKeys condition using the Cognito Identity ID.

To access AWS resources directly from a client application using the AWS SDK, the client must obtain temporary AWS credentials. Amazon Cognito Identity Pools (federated identities) are designed for this purpose. They authenticate users via an identity provider (such as an Amazon Cognito User Pool) and exchange the resulting token for temporary AWS credentials associated with an IAM role. Fine-grained access control to DynamoDB is achieved by attaching a policy to the IAM role that uses the dynamodb:LeadingKeys condition key set to the special AWS variable ${cognito-identity.amazonaws.com:sub}, which represents the user's unique Cognito Identity ID.

Step-by-Step Solution

Identify the authentication and authorization flow required for direct AWS SDK access from the mobile client.

Recognize that while Cognito User Pools handle user directory and authentication (generating JWT tokens), they do not vend temporary AWS credentials needed by the AWS SDK to sign DynamoDB requests. An Amazon Cognito Identity Pool (federated identities) is required to exchange the User Pool JWT for temporary AWS credentials.

This establishes the identity federation pipeline to obtain valid AWS credentials directly on the client.

Configure the Cognito Identity Pool authentication provider.

Link the Cognito User Pool as the authentication provider in the Identity Pool configuration.

This allows the Identity Pool to trust tokens issued by the User Pool and assign an authenticated IAM role to the users.

Implement fine-grained access control on the DynamoDB table using IAM policies.

Create an IAM policy for the authenticated user role that grants access to DynamoDB, utilizing the dynamodb:LeadingKeys condition key set to the user's unique Cognito Identity ID: ${cognito-identity.amazonaws.com:sub}.

This dynamically limits the player's access to only the DynamoDB items where the partition key value matches their authenticated Cognito Identity ID, fulfilling the security requirement.

Key Concept

Cognito Identity Pools handle authorization by exchanging authentication tokens for temporary AWS credentials, enabling fine-grained access control to AWS resources via IAM policy variables.

Question 87Question →

A developer is configuring an AWS Step Functions state machine that will write logs to Amazon CloudWatch Logs, write data directly to an Amazon DynamoDB table, and send notifications to an Amazon SNS topic. The developer is creating an IAM role for the state machine to grant the necessary permissions.

Which two configuration steps must the developer perform to successfully and securely configure this IAM role? (Select two.)

Select all that apply

Configure the trust policy of the IAM role to allow the states.amazonaws.com service principal to assume the role.

Attach a permissions policy to the IAM role that grants permissions for dynamodb:PutItem, sns:Publish, and CloudWatch Logs write actions on the specific target resource ARNs.

Configure the trust policy of the IAM role to allow the dynamodb.amazonaws.com and sns.amazonaws.com service principals to assume the role.

Attach a permissions policy to the IAM role that grants the sts:AssumeRole permission to the DynamoDB and SNS service principals.

Store permanent AWS access keys in the Step Functions state machine definition to authenticate API calls to DynamoDB and SNS.

Show answer & explanation

Answer: Configure the trust policy of the IAM role to allow the states.amazonaws.com service principal to assume the role.; Attach a permissions policy to the IAM role that grants permissions for dynamodb:PutItem, sns:Publish, and CloudWatch Logs write actions on the specific target resource ARNs.

Answer

Configure the trust policy of the IAM role to trust the Step Functions service principal (states.amazonaws.com) and attach a permissions policy that grants access to the specific DynamoDB table, SNS topic, and CloudWatch Logs target resources.

To successfully run the Step Functions state machine with the necessary permissions, two parts of the IAM role configuration are required. First, the trust policy must trust the Step Functions service principal ('states.amazonaws.com') to allow it to assume the role. Second, the permissions policy attached to the role must grant the required access to the target DynamoDB table, SNS topic, and CloudWatch Logs resource ARNs.

Step-by-Step Solution

Identify the service principal that needs to assume the role.

The AWS Step Functions service principal (states.amazonaws.com) requires permission to assume the execution role.

This configuration belongs in the role's trust policy so Step Functions can obtain temporary credentials using the Security Token Service (STS).

Determine the necessary permissions for the application workflow.

The state machine needs permissions to put items in DynamoDB, publish to SNS, and write logs to CloudWatch Logs.

These API operations must be explicitly allowed by attaching an identity-based permissions policy to the execution role.

Apply the principle of least privilege.

Limit the permissions policy resources to specific target ARNs (DynamoDB table, SNS topic, and CloudWatch log group) rather than using wildcards.

This secures the environment by preventing the state machine from accessing unintended resources.

Key Concept

IAM execution roles consist of a trust policy (defining which principal can assume the role) and a permissions policy (defining what actions that role can perform on which resources).

Estimated Time:1m 30s

Question 88Question →

An online learning platform uses Amazon API Gateway to expose a REST API that delivers course catalog data. The platform needs to restrict access to this API so that only users who have registered and authenticated through the platform's Amazon Cognito User Pool can retrieve the catalog. The development team wants to implement this security control with the minimum amount of custom code and operational overhead.

Which configuration should the developer implement to secure the REST API?

Configure an API Gateway Cognito User Pools authorizer on the REST API methods, using the user pool's token for authorization.

Configure an API Gateway Lambda authorizer that calls Cognito Identity Pools to obtain temporary AWS credentials for each user request.

Deploy an API Gateway Lambda authorizer that validates the Cognito JWT token by downloading the JSON Web Key Set (JWKS) and programmatically verifying the signature.

Enable Lambda Proxy Integration on the API Gateway resource and write custom JWT verification logic inside the backend Lambda function.

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pools authorizer on the REST API methods, using the user pool's token for authorization.

Answer

Configure an API Gateway Cognito User Pools authorizer on the REST API methods, using the user pool's token for authorization.

The correct option is the one that configures a native Cognito User Pools authorizer. Amazon API Gateway has built-in integration to validate JSON Web Tokens (JWTs) generated by Amazon Cognito User Pools. This native feature requires zero custom code, provides automatic validation, and handles unauthorized requests at the API Gateway layer before invoking any backend integration, meeting all requirements with the lowest operational overhead.

Step-by-Step Solution

Identify the authentication provider and the requirement for authorization.

The users authenticate using an Amazon Cognito User Pool.

Knowing that users are in a Cognito User Pool helps choose between Cognito-native authorizers and custom authorizers.

Determine the implementation option with the lowest operational overhead and custom code.

API Gateway has a built-in 'Cognito User Pools authorizer' which natively validates Cognito tokens.

Using native integration eliminates the need to write, deploy, or maintain custom code in a Lambda function.

Configure the method execution in API Gateway to use the authorizer.

The REST API methods are secured using the Cognito User Pools authorizer.

This configuration validates the token at the edge before requests reach any backend integration.

Key Concept

API Gateway Cognito User Pools Authorizer

Estimated Time:1m 0s

Question 89Question →

A developer is designing a serverless payment processing application running on AWS Lambda. The application must retrieve the following credentials and configuration settings securely:

1. A third-party API key that is manually rotated every 90 days and must be securely accessed by Lambda functions running in different AWS accounts.
2. A database credential for an Amazon RDS PostgreSQL database that requires automatic rotation every 30 days without causing application downtime.
3. Non-sensitive application configuration parameters (such as timeout limits and connection pool sizes) that must be stored hierarchically and retrieved at minimal cost.

Which of the following configuration options should the developer select to meet these requirements? (Select TWO).

Select all that apply

Store the RDS database credentials and the third-party API key in AWS Secrets Manager, attaching a resource-based policy to the API key secret to grant read access to the Lambda functions in the other AWS accounts.

Store the non-sensitive configuration parameters as Standard parameters in AWS Systems Manager Parameter Store using hierarchical paths.

Store the third-party API key in AWS Systems Manager Parameter Store as a SecureString parameter, and configure a resource-based policy on the parameter to allow the other AWS accounts to retrieve it.

Store the database credentials in AWS Systems Manager Parameter Store, and configure an Amazon EventBridge rule that triggers an AWS Lambda function to rotate the credentials in RDS and update the parameter value.

Hardcode the third-party API key directly in the Lambda function's source code to avoid API retrieval latency, and use the default credential provider chain to authenticate the database client.

Show answer & explanation

Answer: Store the RDS database credentials and the third-party API key in AWS Secrets Manager, attaching a resource-based policy to the API key secret to grant read access to the Lambda functions in the other AWS accounts.; Store the non-sensitive configuration parameters as Standard parameters in AWS Systems Manager Parameter Store using hierarchical paths.

Answer

Store the database credentials and the third-party API key in AWS Secrets Manager, utilizing a resource-based policy for cross-account access to the API key, and store non-sensitive configuration parameters as Standard parameters in AWS Systems Manager Parameter Store.

The correct architecture leverages AWS Secrets Manager for secrets requiring automatic rotation or cross-account access via resource-based policies, and AWS Systems Manager Parameter Store for cost-effective hierarchical configuration storage. Database credentials require automatic rotation, which is a native feature of AWS Secrets Manager for Amazon RDS. The third-party API key needs cross-account access, which is supported in Secrets Manager using resource-based policies. Non-sensitive configurations are best stored as Standard parameters in Parameter Store, as they are free and support hierarchical paths.

Step-by-Step Solution

Analyze the database credential rotation requirement.

Identify that Amazon RDS database credentials require automatic rotation every 30 days.

AWS Secrets Manager natively supports automatic rotation of RDS credentials without custom Lambda code or downtime.

Analyze the third-party API key sharing requirement.

Identify that the API key needs to be securely shared cross-account.

AWS Secrets Manager supports resource-based policies, allowing direct cross-account access without assuming cross-account IAM roles, unlike Systems Manager Parameter Store.

Analyze the non-sensitive configuration storage requirement.

Identify that non-sensitive settings need hierarchical storage at minimal cost.

Systems Manager Parameter Store Standard parameters are free of charge, support hierarchical paths, and are the most cost-effective choice for non-sensitive data.

Key Concept

Distinguishing between AWS Secrets Manager and Systems Manager Parameter Store based on automatic rotation, cross-account access capabilities, and cost efficiency.

Question 90Question →

A retail company is deploying a secure microservices-based application. A developer needs to expose a backend administrative endpoint via an Amazon API Gateway REST API. The API will be accessed exclusively by internal backend applications running on Amazon EC2 instances. The company requires that all requests be authenticated using AWS Signature Version 4 (SigV4) to enforce IAM-based access control. Which two options should the developer configure to secure this API under these requirements?

Select all that apply

Set the API Gateway method authorization type to AWS_IAM.

Attach an IAM policy to the EC2 instances' instance profile that grants execute-api:Invoke permissions on the API Gateway method resource.

Create an Amazon Cognito User Pool Authorizer and configure the EC2 instances to retrieve JWTs by authenticating directly with AWS STS.

Implement a Lambda Authorizer that parses the Authorization header, validates the AWS Signature Version 4 structure, and returns an IAM policy.

Enable Lambda proxy integration and inspect the event's requestContext.authorizer.claims object within the backend Lambda function to verify the IAM role.

Show answer & explanation

Answer: Set the API Gateway method authorization type to AWS_IAM.; Attach an IAM policy to the EC2 instances' instance profile that grants execute-api:Invoke permissions on the API Gateway method resource.

Answer

To secure the API using AWS Signature Version 4 and IAM roles, the developer must set the method authorization type to AWS_IAM and grant the calling applications' EC2 instance profiles an IAM policy with execute-api:Invoke permissions.

The correct options are setting the authorization type to AWS_IAM and attaching an IAM policy with execute-api:Invoke permissions to the EC2 instances' instance profile. Setting the authorization to AWS_IAM utilizes API Gateway's native support for verifying Signature Version 4 headers. For the client application on EC2 to invoke this method, its IAM role must be granted the execute-api:Invoke permission.

Step-by-Step Solution

Configure the API Gateway method to use IAM authentication.

The method's authorization type is set to AWS_IAM.

This native API Gateway feature ensures that all incoming requests must be signed with AWS Signature Version 4 credentials.

Assign permissions to the calling EC2 instances.

An IAM policy with execute-api:Invoke permissions is attached to the instances' IAM execution role.

This allows the calling services to successfully invoke the IAM-authorized API Gateway endpoint.

Key Concept

API Gateway authorization using AWS_IAM and Signature Version 4

Estimated Time:2m 0s

Question 91Question →

A developer needs to encrypt a large data file locally on an application server before uploading it to Amazon S3. The developer wants to use client-side envelope encryption with an AWS KMS customer managed key. Which of the following steps must the developer perform to complete this encryption process? (Select TWO.)

Select all that apply

Call the AWS KMS GenerateDataKey API operation to receive a plaintext data key and an encrypted ciphertext data key.

Encrypt the file locally using the plaintext data key, and then delete the plaintext data key from memory.

Call the AWS KMS Encrypt API operation to encrypt the entire data file directly using the customer managed key.

Call the AWS KMS GenerateDataKeyWithoutPlaintext API operation to obtain the plaintext data key for local encryption.

Save the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to use for decryption.

Show answer & explanation

Answer: Call the AWS KMS GenerateDataKey API operation to receive a plaintext data key and an encrypted ciphertext data key.; Encrypt the file locally using the plaintext data key, and then delete the plaintext data key from memory.

Answer

To encrypt the file using envelope encryption, the developer must call the GenerateDataKey API to obtain the plaintext and ciphertext data keys, encrypt the data locally with the plaintext key, and then delete the plaintext key from memory.

The correct options describe the client-side envelope encryption workflow: calling the GenerateDataKey API to get both the plaintext and ciphertext keys, using the plaintext key to encrypt the file locally, and subsequently discarding the plaintext key from memory.

Step-by-Step Solution

Generate data keys using AWS KMS

The application receives a plaintext data key and a ciphertext data key from the GenerateDataKey API call.

The plaintext key is needed to perform the encryption algorithm locally, and the ciphertext key is needed to store with the data for future decryption.

Encrypt the file locally

The file is encrypted using the plaintext data key.

Envelope encryption uses a unique symmetric data key locally to secure the file content.

Clean up memory and prepare storage

The plaintext key is deleted from the application's memory, and the encrypted file is paired with the ciphertext data key.

Removing the plaintext key from memory minimizes the risk of exposure. The ciphertext data key can be safely stored alongside the encrypted file in S3.

Key Concept

Envelope encryption is the practice of encrypting data with a data key, and then encrypting the data key under another key.

Estimated Time:1m 30s

Question 92Question →

A developer is deploying an AWS Lambda function inside the private subnets of a custom VPC to process internal company data. The function needs to retrieve non-sensitive application settings, such as feature flags and external API endpoint URLs, without traversing the public internet. The architecture must minimize operational costs and must not use NAT Gateways or Internet Gateways. Which configuration should the developer implement to meet these requirements?

Store the configuration settings in AWS Secrets Manager, create an interface VPC endpoint for Secrets Manager in the VPC, and configure the security groups to allow HTTPS traffic between the Lambda function and the Secrets Manager VPC endpoint.

Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, create an interface VPC endpoint for Systems Manager in the VPC, and configure the security groups to allow HTTPS traffic between the Lambda function and the Systems Manager VPC endpoint.

Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, associate the Lambda function with the private subnets of the VPC, and rely on the default AWS Lambda execution role's permissions to bypass network routing and access Parameter Store directly without any VPC endpoints.

Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, create an interface VPC endpoint for Systems Manager in the VPC, and modify the IAM role trust policy of the Lambda execution role to allow the Systems Manager service principal to assume the role.

Show answer & explanation

Answer: Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, create an interface VPC endpoint for Systems Manager in the VPC, and configure the security groups to allow HTTPS traffic between the Lambda function and the Systems Manager VPC endpoint.

Answer

The correct option correctly identifies the need for Systems Manager Parameter Store to handle non-sensitive configuration settings cost-effectively (as standard parameters have no associated cost, unlike Secrets Manager). It also correctly configures an interface VPC endpoint to enable private communication between the Lambda function in the private subnet and the Systems Manager service, bypassing the need for a NAT Gateway or public internet routing.

Step-by-Step Solution

Analyze cost and data sensitivity requirements.

Identify that the settings are non-sensitive and the architecture must minimize operational costs, leading to the selection of AWS Systems Manager Parameter Store standard parameters, which are free of charge, over AWS Secrets Manager.

AWS Secrets Manager charges a flat rate per secret per month, which increases operational costs unnecessarily for non-sensitive configuration settings.

Analyze network path constraints.

Recognize that because the Lambda function is attached to a private subnet in a VPC with no NAT Gateway or Internet Gateway, it lacks a default route to public AWS endpoints over the internet.

AWS resources inside a custom VPC private subnet cannot resolve or connect to public service endpoints like Parameter Store without an explicit routing path.

Select the private connectivity mechanism.

Establish an interface VPC endpoint (AWS PrivateLink) specifically for Systems Manager (com.amazonaws.region.ssm) in the custom VPC.

An interface VPC endpoint places elastic network interfaces (ENIs) with private IP addresses in the subnets, enabling secure and private connections to AWS services.

Configure the security groups.

Allow outbound HTTPS (TCP port 443) from the Lambda function's security group to the interface VPC endpoint's security group, and inbound HTTPS on the endpoint's security group from the Lambda function.

Security groups are stateful and must explicitly allow the necessary traffic to complete the PrivateLink network connection.

Key Concept

Configuring private access to AWS services via Interface VPC Endpoints (AWS PrivateLink) for resource-constrained architectures.

Estimated Time:2m 0s

Question 93Question →

A startup is building a multi-tenant SaaS application on AWS. The application exposes a REST API through Amazon API Gateway. The startup uses an Amazon Cognito User Pool for user authentication, and the frontend client receives a JSON Web Token (JWT) after successful login. The developer needs to secure a set of API endpoints: some endpoints require validation of standard JWT claims, while other endpoints require validating the JWT and then looking up the user's subscription status in a DynamoDB table to grant or deny access. Which two configuration methods should the developer use on the API Gateway endpoints to meet these requirements with the least operational overhead? (Select TWO.)

Select all that apply

Configure a built-in API Gateway Amazon Cognito user pool authorizer for endpoints that only require standard JWT claim validation.

Configure an API Gateway Lambda authorizer of token type for endpoints that require querying the database to check subscription status.

Configure an API Gateway Lambda authorizer of request parameter type to manually verify the JWT signature and expiration for standard claims.

Configure an Amazon Cognito Identity Pool authorizer directly on API Gateway to validate the JWT and verify the subscription status.

Configure API Gateway Lambda Proxy integration with IAM authorization to automatically pass the client JWT to the backend Lambda function.

Show answer & explanation

Answer: Configure a built-in API Gateway Amazon Cognito user pool authorizer for endpoints that only require standard JWT claim validation.; Configure an API Gateway Lambda authorizer of token type for endpoints that require querying the database to check subscription status.

Answer

To secure the API endpoints with minimal operational overhead, the developer should configure a built-in API Gateway Amazon Cognito user pool authorizer for the standard JWT claim validation, and configure an API Gateway Lambda authorizer of token type for endpoints requiring a DynamoDB database lookup.

For endpoints requiring only standard validation of Cognito User Pool JWTs, using the built-in API Gateway Cognito User Pool authorizer requires no custom code, minimizing operational overhead. For endpoints requiring database checks (such as verifying subscription status in DynamoDB), a custom Lambda authorizer must be used to execute the custom database query and return the corresponding IAM policy.

Step-by-Step Solution

Analyze endpoint requirements

Identified two distinct types of authentication requirements: simple validation of Cognito JWT claims, and custom validation requiring a database lookup.

This determines the capabilities required for the authorizers on each API route.

Select authorization method for standard validation

Chose the built-in Amazon Cognito user pool authorizer.

API Gateway natively validates Cognito User Pool JWTs without custom code, satisfying the least operational overhead criteria.

Select authorization method for custom database validation

Chose an API Gateway Lambda authorizer of token type.

Because checking a database requires custom execution logic not supported by the built-in Cognito authorizer, a Lambda authorizer must be used to perform the query and return an IAM policy.

Key Concept

API Gateway Authorizers selection based on requirement complexity

Question 94Question →

A developer is implementing a security strategy for an application. The application needs to retrieve a database password and also encrypt application audit logs (average size $2\text{ MB}$ ) locally before archiving them to Amazon S3. The database password requires automatic rotation. The audit logs must be encrypted client-side using a customer managed key (KMS key) in AWS KMS. Which combination of services and KMS operations should the developer use to meet these requirements?

Store the database password in AWS Secrets Manager to enable automatic rotation. For the audit logs, call GenerateDataKey to obtain a plaintext data key and an encrypted data key, encrypt the logs locally with the plaintext key, and store the encrypted data key alongside the encrypted logs in S3.

Store the database password in Systems Manager Parameter Store to enable automatic rotation. For the audit logs, call Encrypt to encrypt the logs directly using the customer managed key before uploading them to S3.

Store the database password in AWS Secrets Manager. For the audit logs, call Decrypt to retrieve the plaintext customer managed key, encrypt the logs locally with the customer managed key, and upload them to S3.

Store the database password in AWS Secrets Manager. For the audit logs, call GenerateDataKeyWithoutPlaintext to obtain an encrypted data key, encrypt the logs locally using the encrypted data key, and upload them to S3.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager to enable automatic rotation. For the audit logs, call GenerateDataKey to obtain a plaintext data key and an encrypted data key, encrypt the logs locally with the plaintext key, and store the encrypted data key alongside the encrypted logs in S3.

Answer

The correct approach uses AWS Secrets Manager for the database password because it provides out-of-the-box automatic rotation. For the audit logs, since the payload size (

2\text{ MB}

) exceeds the

4\text{ KB}

limit of the KMS Encrypt API, the application must use envelope encryption. The GenerateDataKey API returns both the plaintext data key (used to encrypt the file locally) and the ciphertext data key (stored alongside the encrypted logs for future decryption).

Step-by-Step Solution

Select the appropriate secrets management service.

AWS Secrets Manager is selected because it natively supports database credential rotation, whereas Systems Manager Parameter Store does not.

Meeting the requirement for automatic rotation of the database password.

Determine the encryption method for the

2\text{ MB}

audit logs.

The Encrypt API has a

4\text{ KB}

limit, so client-side envelope encryption must be used.

Enabling the encryption of large files that exceed the KMS direct encryption payload limit.

Identify the correct KMS API call for envelope encryption.

GenerateDataKey is chosen because it returns the plaintext key needed for local encryption and the ciphertext key for storage.

Obtaining the necessary keys to encrypt the data locally and decrypt it later.

Key Concept

AWS KMS Envelope Encryption and Secrets Management

Estimated Time:1m 30s

Question 95Question →

A developer is implementing security for a new Amazon API Gateway REST API. The API has two specific endpoints:

1. `POST /orders`: Used by a mobile application where users authenticate via Amazon Cognito User Pools.
2. `GET /dashboard/metrics`: Used by an administrative reporting service running on Amazon ECS tasks.

Which TWO actions should the developer take to configure authorization for these endpoints with the least operational overhead?

Select all that apply

Configure the `POST /orders` method to use an Amazon Cognito User Pools authorizer to validate incoming tokens.

Configure the `GET /dashboard/metrics` method to use `AWS_IAM` authorization, and grant the ECS task role permission to invoke the API.

Configure the `POST /orders` method to use an Amazon Cognito Identity Pool authorizer to validate user identity.

Create a custom Lambda authorizer for the `POST /orders` method that parses and manually validates the JSON Web Tokens (JWTs) from the mobile clients.

Configure a Lambda custom integration for `GET /dashboard/metrics` that manually decodes and extracts IAM credentials from the raw request payload.

Show answer & explanation

Answer: Configure the `POST /orders` method to use an Amazon Cognito User Pools authorizer to validate incoming tokens.; Configure the `GET /dashboard/metrics` method to use `AWS_IAM` authorization, and grant the ECS task role permission to invoke the API.

Answer

Configure the POST /orders method to use an Amazon Cognito User Pools authorizer, and configure the GET /dashboard/metrics method to use AWS_IAM authorization while granting the ECS task role permission to invoke the API.

For the POST /orders endpoint, using a built-in Amazon Cognito User Pools authorizer is the recommended path because it requires zero custom code to validate Cognito-issued tokens. For the GET /dashboard/metrics endpoint, AWS_IAM authorization allows the administrative service running on ECS to leverage its IAM task role to sign requests with Signature Version 4, offering a secure, native method to control access without API keys or token exchange.

Step-by-Step Solution

Analyze the requirement for the POST /orders endpoint to authenticate mobile users authenticated with Amazon Cognito User Pools.

Identify that API Gateway offers a native Cognito User Pools authorizer.

This authorizer directly validates JWT tokens from Cognito without custom code, minimizing operational overhead.

Analyze the requirement for the GET /dashboard/metrics endpoint to secure access for an administrative service on Amazon ECS.

Identify that the service uses an IAM role and API Gateway supports native AWS_IAM authorization.

AWS_IAM authorization allows callers to sign requests with SigV4 and enables native access control via IAM policies.

Configure permissions for the ECS task role to invoke the GET /dashboard/metrics endpoint.

Grant execute-api:Invoke permission on the API resource to the ECS task role.

This secures access based on the principle of least privilege.

Key Concept

API Gateway Security and Authorization using built-in Cognito and IAM authorizers

Question 96Question →

A developer is configuring a database connection for a new application. The database credentials must be rotated automatically every 15 days, and the developer wants to use native integration with Amazon RDS to rotate them without writing custom rotation code. Which AWS service should the developer use to store the credentials?

AWS Secrets Manager

AWS Systems Manager Parameter Store using a SecureString parameter type

Hardcoded database credentials stored directly within the application initialization code

AWS Key Management Service (AWS KMS) data keys stored in the application environment variables

Show answer & explanation

Answer: AWS Secrets Manager

Answer

AWS Secrets Manager

AWS Secrets Manager is designed for storing and managing secrets, offering built-in integration with Amazon RDS to automatically rotate database credentials without requiring custom code.

Step-by-Step Solution

Identify the requirement for automatic credential rotation every 15 days.

Automatic rotation is a native feature of AWS Secrets Manager but is not natively supported by Systems Manager Parameter Store.

Secrets Manager provides out-of-the-box rotation support for popular database services like Amazon RDS.

Evaluate the requirement for native RDS integration without writing custom rotation code.

AWS Secrets Manager provides built-in rotation templates for RDS, whereas other services would require writing custom rotation logic.

Using native RDS integration simplifies the operational overhead of rotation.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store features, specifically automatic rotation and database integration.

Estimated Time:45s

Question 97Question →

A developer is designing a security architecture for a corporate mobile application that accesses backend microservices through an Amazon API Gateway REST API. The application requirements specify that all API requests must be secured using AWS Signature Version 4 (SigV4) signing, and users must obtain temporary AWS IAM credentials after authenticating with a third-party Identity Provider (IdP). Which configuration should the developer implement to authorize these requests at the API Gateway level with the least administrative effort?

Configure the API Gateway methods to use AWS_IAM authorization. Authenticate users through an Amazon Cognito identity pool to exchange their third-party IdP token for temporary AWS credentials, and use those credentials to sign requests using Signature Version 4 (SigV4).

Configure the API Gateway methods to use a Cognito User Pool authorizer. Authenticate users through an Amazon Cognito user pool to exchange their third-party IdP token for temporary AWS credentials, and use those credentials to sign requests using Signature Version 4 (SigV4).

Configure a Lambda authorizer on the API Gateway REST API. Write custom validation logic inside the authorizer function to verify the third-party IdP token, generate temporary AWS credentials, and return them to the client to sign requests using Signature Version 4 (SigV4).

Configure the API Gateway REST API with Lambda proxy integration. Validate the third-party IdP token directly in the backend Lambda function, request temporary AWS credentials using AWS Security Token Service (STS), and return them in the API response headers to sign future requests.

Show answer & explanation

Answer: Configure the API Gateway methods to use AWS_IAM authorization. Authenticate users through an Amazon Cognito identity pool to exchange their third-party IdP token for temporary AWS credentials, and use those credentials to sign requests using Signature Version 4 (SigV4).

Answer

Configuring API Gateway to use AWS_IAM authorization requires clients to sign their requests with AWS Signature Version 4 (SigV4). By integrating the third-party Identity Provider (IdP) with an Amazon Cognito identity pool (federated identities), the application can exchange the IdP authentication token for temporary, limited-privilege AWS credentials. The client can then use these credentials to sign the API requests, providing secure, native API Gateway authorization with minimal operational overhead.

Step-by-Step Solution

Enable AWS_IAM authorization on the API Gateway REST API resource methods.

API Gateway will reject any unsigned requests or requests not signed with valid AWS Signature Version 4 (SigV4) credentials.

To enforce SigV4 authentication at the API Gateway level, ensuring only authorized AWS identities can access the backend.

Set up an Amazon Cognito identity pool and configure the third-party Identity Provider (IdP) as an authentication provider.

Users authenticate with the IdP and obtain an ID token, which the application exchanges with the Cognito identity pool for temporary AWS IAM credentials.

To map external federated identities to temporary AWS IAM credentials for the client application.

Sign the API Gateway HTTP requests using the retrieved temporary AWS IAM credentials in the client application.

The client successfully sends SigV4-signed requests that API Gateway validates against the IAM permissions associated with the Cognito identity pool's authenticated role.

To complete the SigV4 handshake and securely access the authorized API Gateway endpoints.

Key Concept

API Gateway AWS_IAM authorization secures endpoints by requiring clients to sign requests with AWS Signature Version 4 (SigV4) credentials. Combining this with Cognito Identity Pools allows external authenticated identities to obtain the temporary credentials needed for SigV4 signing.

Estimated Time:1m 30s

Question 98Question →

A developer is building a mobile application that uses Amazon Cognito for user authentication. The backend is exposed through an Amazon API Gateway REST API. The developer needs to secure the API so that only authenticated users can access the endpoints. The authentication mechanism must validate JSON Web Tokens (JWTs) issued by Cognito, require no custom authorizer code, and introduce minimal latency. Which API Gateway authorization method should the developer implement?

An Amazon Cognito User Pools authorizer

An Amazon Cognito Identity Pools authorizer

A Lambda custom authorizer with token verification

A Lambda proxy integration with manual token parsing

Show answer & explanation

Answer: An Amazon Cognito User Pools authorizer

Answer

An Amazon Cognito User Pools authorizer

The correct answer is the Amazon Cognito User Pools authorizer. API Gateway provides built-in integration with Cognito User Pools to validate identity tokens (IDs) or access tokens returned from Cognito. This requires no custom coding, operates at the API Gateway level to block unauthorized requests, and minimizes overhead.

Step-by-Step Solution

Identify the authentication source and token type.

The application uses Amazon Cognito for user authentication and receives JWTs.

This narrows the choices down to Cognito-integrated methods.

Evaluate the operational overhead and custom code requirement.

Amazon API Gateway offers a built-in Cognito User Pools authorizer that directly validates JWTs without requiring custom code.

This rules out a Lambda authorizer, which requires custom verification code, and Cognito Identity Pools, which are for AWS credential vending.

Key Concept

Amazon API Gateway Cognito User Pools Authorizer

Estimated Time:45s

Question 99Question →

A developer is building a mobile application where users authenticate via Amazon Cognito. The backend services are exposed through an Amazon API Gateway REST API. The developer needs to restrict access to the API endpoints so that only successfully authenticated users from a specific Amazon Cognito User Pool can call the API. The mobile client sends the id_token in the Authorization header. Which configuration represents the most operationally efficient and secure solution?

Configure an API Gateway Cognito Authorizer pointing to the Amazon Cognito User Pool, and set the Authorization header as the token source.

Create a custom Lambda authorizer that retrieves the JSON Web Key Set (JWKS) from the Cognito User Pool, validates the signature of the incoming token, and returns an IAM policy.

Configure an API Gateway Cognito Authorizer pointing to an Amazon Cognito Identity Pool, mapping the token to temporary AWS credentials to authorize the requests.

Configure a Lambda Proxy Integration for the API methods, and implement custom code within the backend Lambda function to inspect the Authorization header and validate the token.

Show answer & explanation

Answer: Configure an API Gateway Cognito Authorizer pointing to the Amazon Cognito User Pool, and set the Authorization header as the token source.

Answer

Configure an API Gateway Cognito Authorizer pointing to the Amazon Cognito User Pool, and set the Authorization header as the token source.

The correct answer configures a native API Gateway Cognito Authorizer referencing the User Pool. This approach allows API Gateway to automatically and natively validate token signatures, audiences, and expiration, offloading the security checks from the backend application code and saving operational costs.

Step-by-Step Solution

Identify the authentication source and token format.

Amazon Cognito User Pool id_token (JWT).

Knowing that users authenticate via User Pools and produce standard JWTs helps choose the appropriate native integration.

Select the API Gateway authorization type that natively handles Cognito JWT verification.

API Gateway Cognito Authorizer.

A Cognito Authorizer allows API Gateway to directly validate token signatures, expiration, and audiences without invoking custom code or Lambda functions.

Configure the token source in API Gateway.

Set token source to the 'Authorization' header.

This instructs API Gateway to extract the id_token from the Authorization header of the incoming HTTP request.

Key Concept

API Gateway Cognito Authorizer

Estimated Time:1m 30s

Question 100Question →

A developer is deploying an AWS Lambda function inside a private subnet of a Virtual Private Cloud (VPC) to access an Amazon RDS database. The Lambda function also needs to connect to an external payment processor's public API over the internet. Which configuration should the developer use to allow the Lambda function to access the internet?

Configure a NAT Gateway in a public subnet, and add a route in the private subnet's route table that directs internet-bound traffic to the NAT Gateway.

Configure the Lambda function to run inside the private subnet without configuring a NAT Gateway or VPC endpoints, assuming the default subnet routing allows outbound internet traffic.

Modify the IAM execution role's trust policy of the Lambda function to permit direct public internet connections to external IP ranges.

Store the payment processor's API key in AWS Systems Manager Parameter Store and enable automatic rotation to open an internet-bound route.

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet, and add a route in the private subnet's route table that directs internet-bound traffic to the NAT Gateway.

Answer

Configure a NAT Gateway in a public subnet, and add a route in the private subnet's route table that directs internet-bound traffic to the NAT Gateway.

The correct option correctly states that a NAT Gateway must be configured in a public subnet and the private subnet's route table updated to direct destination

0.0.0.0/0

traffic to the NAT Gateway. This allows Lambda functions inside the private subnet to establish outbound connections to the internet without exposing them to inbound internet traffic.

Step-by-Step Solution

Identify that the Lambda function is running inside a private subnet and needs to connect to the public internet.

The Lambda function does not have a public IP address and cannot directly route traffic to an Internet Gateway.

AWS Lambda functions configured in a VPC are assigned private IP addresses only.

Select the appropriate network gateway that allows outbound-only internet access for private subnet resources.

Identify a NAT Gateway placed in a public subnet of the same VPC.

A NAT Gateway translates the private IP addresses of resources in private subnets to a public IP to communicate with the internet.

Update the routing table associated with the private subnet containing the Lambda function.

Add a route for

0.0.0.0/0

pointing to the NAT Gateway's ID.

This routes all non-VPC bound traffic (internet traffic) securely to the NAT Gateway.

Key Concept

VPC Routing and NAT Gateway for private subnet resources

Estimated Time:1m 0s

PreviousPage 5 / 20Next

Security

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept