VPC Security for Developers

40 questions

All types40 Multiple choice21 Multiple select19

A developer is configuring a backend microservice running on AWS Lambda within a custom VPC. The Lambda function must connect to a private Amazon Aurora PostgreSQL database in the same VPC and retrieve secure configurations from AWS Systems Manager Parameter Store. The company's security policy strictly prohibits internet gateways and NAT gateways. The developer sets up an Interface VPC Endpoint for Systems Manager. Which two configurations must the developer implement to secure this traffic and establish connectivity? (Select TWO.)

Select all that apply

Configure the database's security group to allow inbound TCP traffic on port

5432

from the security group assigned to the Lambda function.

Configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port

443

) traffic from the security group assigned to the Lambda function.

Add a route in the private subnet route table pointing destination

0.0.0.0/0

to the Systems Manager VPC Endpoint network interface.

Configure the private subnet's Network Access Control List (NACL) to allow inbound traffic from the database, relying on the stateful nature of NACLs to permit return traffic.

Modify the Lambda execution role's trust policy to allow the Systems Manager service endpoint (ssm.amazonaws.com) to assume the role.

Show answer & explanation

Answer: Configure the database's security group to allow inbound TCP traffic on port $5432$ from the security group assigned to the Lambda function.; Configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port $443$ ) traffic from the security group assigned to the Lambda function.

Answer

Configure the database's security group to allow inbound TCP traffic on port

5432

from the security group assigned to the Lambda function, and configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port

443

) traffic from the security group assigned to the Lambda function.

The database security group must allow inbound PostgreSQL traffic (port

5432

) from the Lambda function's security group. Interface VPC endpoints use security groups to control incoming traffic; therefore, the Systems Manager endpoint's security group must permit inbound HTTPS (port

443

) traffic from the Lambda function's security group. Since security groups are stateful, configuring these inbound rules automatically allows the corresponding outbound/return traffic.

Step-by-Step Solution

Analyze database connectivity requirements.

Identify that the Lambda function must connect to Aurora PostgreSQL on port

5432

To authorize this traffic, the database's security group must permit inbound traffic from the source (the Lambda function's security group).

Analyze Systems Manager Parameter Store connectivity requirements.

Identify that the Lambda function must connect to Systems Manager via an Interface VPC Endpoint using HTTPS on port

443

To authorize this traffic, the endpoint's security group must allow inbound traffic from the Lambda function's security group.

Evaluate security group statefulness.

Recognize that because security groups are stateful, return traffic is automatically allowed once the inbound/outbound connection is established.

This eliminates the need to configure ephemeral port rules on the security groups.

Key Concept

VPC security controls (Security Groups, NACLs, and Interface VPC Endpoints) for private AWS service integrations.

Estimated Time:2m 30s

Question 2Question →

A developer is deploying an AWS Lambda function that must connect to an Amazon ElastiCache (Redis OSS) cluster. The ElastiCache cluster is running in the private subnets of a custom VPC. The Lambda function does not need access to the public internet or external APIs. Which of the following configuration steps must the developer perform to establish secure network connectivity between the Lambda function and the ElastiCache cluster? (Select TWO.)

Select all that apply

Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group.

Configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.

Provision a NAT Gateway in the private subnet and update the subnet route tables to route ElastiCache traffic through it.

Modify the Lambda function's IAM execution role trust policy to allow the ElastiCache service to assume the role.

Store the ElastiCache security group ID in AWS Secrets Manager to automatically authorize traffic and bypass security group checks.

Show answer & explanation

Answer: Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group.; Configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.

Answer

Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group, and configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.

To allow the Lambda function to reach the ElastiCache cluster, the Lambda function must first be attached to the same VPC. This is done by configuring VPC access on the Lambda function, which deploys ENIs in the specified private subnets. Second, since security groups are stateful and deny all inbound traffic by default, the ElastiCache security group must be updated to allow inbound TCP traffic on the Redis port from the security group associated with the Lambda function.

Step-by-Step Solution

Enable VPC access for the Lambda function.

The Lambda function is assigned Elastic Network Interfaces (ENIs) in the specified private subnets, enabling it to reach resources inside the VPC.

By default, Lambda functions run in an AWS-managed network that cannot directly communicate with private subnets inside a custom VPC.

Configure the database security group.

The stateful firewall allows incoming network connections from the Lambda function's security group on the specific Redis database port.

Security groups deny all inbound traffic by default, so you must explicitly authorize access from the client's security group.

Key Concept

To enable secure communication between an AWS Lambda function and an internal VPC resource (like ElastiCache), the Lambda function must be associated with the private subnets of the VPC, and the destination security group must explicitly allow inbound traffic from the Lambda function's security group. Internal VPC communication uses local routes and does not require a NAT Gateway.

Question 3Question →

An AWS Lambda function is configured to run within private subnets of a custom VPC to securely query an Amazon Aurora database. The function also needs to retrieve database credentials stored as secure strings in AWS Systems Manager Parameter Store. During testing, the Lambda function times out when attempting to retrieve the parameters, though database connectivity works perfectly. A developer confirms that there is no NAT Gateway configured in the VPC.

Which configuration change will resolve the timeout issue while maintaining the current network architecture and database security?

Establish an interface VPC endpoint for Systems Manager (ssm) within the private subnets, associating a security group that allows inbound HTTPS traffic from the Lambda function's security group.

Attach an IAM policy to the Lambda execution role that grants ssm:GetParameters access, which enables the VPC-bound Lambda function to bypass the private subnet's routing table to reach the public Systems Manager service.

Update the trust relationship policy document of the Lambda execution role to allow the Systems Manager service principal (ssm.amazonaws.com) to assume the role and push parameter values.

Migrate the database credentials from Parameter Store to AWS Secrets Manager, as Systems Manager Parameter Store does not support private VPC endpoint connections or secure string encryption.

Show answer & explanation

Answer: Establish an interface VPC endpoint for Systems Manager (ssm) within the private subnets, associating a security group that allows inbound HTTPS traffic from the Lambda function's security group.

Answer

Establish an interface VPC endpoint for Systems Manager (ssm) within the private subnets, associating a security group that allows inbound HTTPS traffic from the Lambda function's security group.

The correct answer is to establish an interface VPC endpoint for Systems Manager (ssm) within the private subnets, associating a security group that allows inbound HTTPS traffic from the Lambda function's security group. Since the Lambda function is running in a private subnet with no NAT Gateway, it has no route to the public internet to reach the default Systems Manager endpoint. Creating an interface VPC endpoint places Elastic Network Interfaces (ENIs) with private IP addresses directly in the private subnets. The Lambda function can then access Parameter Store privately over port 443, provided the endpoint's security group allows inbound traffic from the Lambda function's security group.

Step-by-Step Solution

Analyze the network configuration of the Lambda function.

The Lambda function resides in a private subnet with no NAT Gateway, preventing access to public AWS service endpoints.

By default, resource-bound Lambda functions route traffic through the VPC's routing tables. Without a NAT Gateway or VPC endpoint, they cannot resolve or connect to public services.

Select the correct AWS PrivateLink service endpoint.

Identify that Systems Manager Parameter Store can be accessed privately via an interface VPC endpoint (ssm service).

Interface VPC endpoints provision Elastic Network Interfaces (ENIs) within the subnets, enabling private routing within the AWS network.

Configure the security groups for the VPC endpoint.

Associate a security group with the interface VPC endpoint that allows inbound HTTPS (port 443) traffic from the Lambda function's security group.

Since security groups are stateful and default to blocking all inbound traffic, the endpoint's security group must explicitly allow inbound requests from the client (Lambda).

Key Concept

VPC Interface Endpoints (AWS PrivateLink) and Security Group configurations for private AWS service integration.

Estimated Time:2m 30s

Question 4Question →

A serverless invoice processing application uses a Lambda function to query a relational database residing in a private subnet of a custom VPC. The function also needs to call a third-party billing service endpoint on the public internet.

Which of the following configurations are required to establish this network connectivity while maintaining secure access? (Select TWO.)

Select all that apply

Associate the Lambda function with the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway located in a public subnet.

Configure a security group for the Lambda function that permits outbound traffic to the database port and to the internet on HTTPS port 443.

Place the Lambda function in a public subnet of the VPC and enable the default auto-assign public IP setting on the function configuration to reach the billing endpoint directly.

Modify the Lambda function's execution role trust policy to allow inbound database connections from the security group of the database.

Store the database credentials in Systems Manager Parameter Store and enable the native database credential rotation feature.

Show answer & explanation

Answer: Associate the Lambda function with the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway located in a public subnet.; Configure a security group for the Lambda function that permits outbound traffic to the database port and to the internet on HTTPS port 443.

Answer

To establish network connectivity for the Lambda function, associate it with the private subnets of the VPC and route outbound internet traffic through a NAT Gateway in a public subnet. Additionally, configure the function's security group to allow outbound traffic to the database port and to the internet on HTTPS port 443.

The correct configurations are to associate the Lambda function with the private subnets of the VPC, routing outbound internet traffic through a NAT Gateway in a public subnet, and configure a security group for the Lambda function that permits outbound traffic to both the database port and HTTPS port 443. This setup ensures that the Lambda function can resolve and reach local resources like the database, while securely routing outbound internet traffic to the external endpoint via the NAT Gateway.

Step-by-Step Solution

Determine subnet placement for the Lambda function.

The Lambda function is associated with private subnets of the custom VPC to allow secure communication with the database.

Private resources should not be exposed to the public internet, and Lambda needs VPC network interfaces (ENIs) in the same subnets to reach the database.

Enable internet connectivity for the private subnets.

Configure a NAT Gateway in a public subnet, and add a route in the private subnets' route table pointing 0.0.0.0/0 traffic to the NAT Gateway.

Lambda functions in private subnets cannot reach the public internet directly; they require a NAT Gateway to translate private IPs to a public IP for internet access.

Configure the Lambda function's Security Group rules.

Add outbound rules allowing traffic to the database's Security Group on its port, and outbound HTTPS traffic to the internet.

Security groups are stateful and must explicitly allow the outbound traffic initiated by the Lambda function.

Key Concept

VPC Security for Lambda and Resource Access

Estimated Time:1m 30s

Question 5Question →

A developer is configuring an AWS Lambda function inside a private subnet of a VPC. The Lambda function needs to read messages from an Amazon SQS queue and write records to an Amazon ElastiCache for Redis cluster located in another private subnet within the same VPC. The Lambda function is successfully writing to ElastiCache but is unable to connect to the Amazon SQS service. Which configuration change should the developer make to resolve this connectivity issue in the most secure manner?

Modify the IAM trust policy of the Lambda function's execution role to include the Amazon SQS service principal (sqs.amazonaws.com) as a trusted entity.

Move the Lambda function to a public subnet within the VPC to allow it to communicate directly with the public Amazon SQS endpoints.

Create an interface VPC endpoint for Amazon SQS in the VPC, and update the security groups to allow traffic between the Lambda function and the endpoint.

Store the SQS queue URL in AWS Secrets Manager, and configure the Lambda function to retrieve it using the Secrets Manager API to bypass the network route.

Show answer & explanation

Answer: Create an interface VPC endpoint for Amazon SQS in the VPC, and update the security groups to allow traffic between the Lambda function and the endpoint.

Answer

Create an interface VPC endpoint for Amazon SQS in the VPC, and update the security groups to allow traffic between the Lambda function and the endpoint.

Creating an interface VPC endpoint (powered by AWS PrivateLink) for Amazon SQS allows resources in private subnets to communicate privately with the service without traversing the public internet or needing a NAT Gateway. Since the Lambda function is in a private subnet, it can route SQS traffic through this private endpoint.

Step-by-Step Solution

Identify the destination endpoint requirements.

Amazon SQS is a public AWS service, which means a resource inside a private subnet without internet access cannot reach it directly.

The Lambda function needs a path to reach the public SQS API, which can be accomplished either via public internet routing (NAT Gateway) or a private path (VPC endpoint).

Select the most secure connectivity method that does not expose the traffic to the public internet.

An Interface VPC Endpoint for SQS (com.amazonaws.region.sqs) provides private, secure connectivity.

VPC endpoints use AWS PrivateLink to keep traffic within the AWS network, satisfying the security requirement.

Update security groups and routing to allow traffic.

Ensure the Lambda function's security group allows outbound traffic to the VPC endpoint, and the endpoint's security group allows inbound HTTPS traffic from the Lambda function.

Security groups are stateful and must explicitly allow the connection from the client to the endpoint.

Key Concept

Establishing private connectivity to public AWS services from within a VPC using Interface VPC Endpoints (AWS PrivateLink).

Estimated Time:1m 30s

Question 6Question →

A software developer is writing a data reconciliation script that runs on AWS Lambda. The script must retrieve credentials from AWS Secrets Manager and query a PostgreSQL database hosted on an Amazon RDS instance that resides in the private subnets of a custom VPC. The Lambda function must run inside the custom VPC to connect to the database. Security policies require that all network traffic between the Lambda function, the database, and AWS Secrets Manager remains entirely within the VPC.

Which of the following actions should the developer take to establish secure and functional network connectivity for the Lambda function? (Select TWO.)

Select all that apply

Configure the Lambda function to connect to the private subnets of the VPC, and create an Interface VPC Endpoint for AWS Secrets Manager with Private DNS enabled.

Configure the security group of the Amazon RDS instance to allow inbound database traffic from the security group assigned to the Lambda function.

Configure the Lambda function to connect directly to the public subnets of the VPC to enable direct access to both the RDS database and the public Secrets Manager endpoint.

Modify the IAM trust relationship of the Lambda execution role to trust the Amazon RDS service principal (rds.amazonaws.com).

Store the database credentials in Systems Manager Parameter Store, and enable native automatic rotation using the Parameter Store console.

Show answer & explanation

Answer: Configure the Lambda function to connect to the private subnets of the VPC, and create an Interface VPC Endpoint for AWS Secrets Manager with Private DNS enabled.; Configure the security group of the Amazon RDS instance to allow inbound database traffic from the security group assigned to the Lambda function.

Answer

The correct actions are: configuring the Lambda function to connect to the private subnets of the VPC while creating an Interface VPC Endpoint for AWS Secrets Manager, and configuring the security group of the Amazon RDS instance to allow inbound traffic from the Lambda function's security group.

To connect the Lambda function to the database securely, the function must reside in the same VPC private subnets. An Interface VPC Endpoint (PrivateLink) for AWS Secrets Manager is required to allow the function to call Secrets Manager APIs over private IP addresses. Additionally, the RDS security group must explicitly allow inbound traffic from the security group associated with the Lambda function.

Step-by-Step Solution

Determine the network placement for the Lambda function.

The Lambda function must be associated with the private subnets of the VPC to route traffic to the RDS instance in the same private subnets.

VPC-connected Lambda functions need to be in subnets that have a network path to the resources they need to access.

Set up secure connection to AWS Secrets Manager.

Create an Interface VPC Endpoint (AWS PrivateLink) for Secrets Manager in the VPC subnets with Private DNS enabled.

This allows the Lambda function to resolve the Secrets Manager DNS name to a private IP within the VPC, ensuring traffic does not traverse the public internet.

Configure Security Group rules for RDS.

Add an inbound rule to the RDS security group that permits traffic on the database port (e.g., port 5432 for PostgreSQL) from the security group attached to the Lambda function.

Security groups act as a firewall at the resource level, and this rule is required to permit the inbound connection from the Lambda function.

Key Concept

VPC Security for Developers

Estimated Time:2m 30s

Question 7Question →

A developer is deploying an AWS Lambda function inside the private subnets of a custom VPC to process internal company data. The function needs to retrieve non-sensitive application settings, such as feature flags and external API endpoint URLs, without traversing the public internet. The architecture must minimize operational costs and must not use NAT Gateways or Internet Gateways. Which configuration should the developer implement to meet these requirements?

Store the configuration settings in AWS Secrets Manager, create an interface VPC endpoint for Secrets Manager in the VPC, and configure the security groups to allow HTTPS traffic between the Lambda function and the Secrets Manager VPC endpoint.

Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, create an interface VPC endpoint for Systems Manager in the VPC, and configure the security groups to allow HTTPS traffic between the Lambda function and the Systems Manager VPC endpoint.

Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, associate the Lambda function with the private subnets of the VPC, and rely on the default AWS Lambda execution role's permissions to bypass network routing and access Parameter Store directly without any VPC endpoints.

Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, create an interface VPC endpoint for Systems Manager in the VPC, and modify the IAM role trust policy of the Lambda execution role to allow the Systems Manager service principal to assume the role.

Show answer & explanation

Answer: Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, create an interface VPC endpoint for Systems Manager in the VPC, and configure the security groups to allow HTTPS traffic between the Lambda function and the Systems Manager VPC endpoint.

Answer

The correct option correctly identifies the need for Systems Manager Parameter Store to handle non-sensitive configuration settings cost-effectively (as standard parameters have no associated cost, unlike Secrets Manager). It also correctly configures an interface VPC endpoint to enable private communication between the Lambda function in the private subnet and the Systems Manager service, bypassing the need for a NAT Gateway or public internet routing.

Step-by-Step Solution

Analyze cost and data sensitivity requirements.

Identify that the settings are non-sensitive and the architecture must minimize operational costs, leading to the selection of AWS Systems Manager Parameter Store standard parameters, which are free of charge, over AWS Secrets Manager.

AWS Secrets Manager charges a flat rate per secret per month, which increases operational costs unnecessarily for non-sensitive configuration settings.

Analyze network path constraints.

Recognize that because the Lambda function is attached to a private subnet in a VPC with no NAT Gateway or Internet Gateway, it lacks a default route to public AWS endpoints over the internet.

AWS resources inside a custom VPC private subnet cannot resolve or connect to public service endpoints like Parameter Store without an explicit routing path.

Select the private connectivity mechanism.

Establish an interface VPC endpoint (AWS PrivateLink) specifically for Systems Manager (com.amazonaws.region.ssm) in the custom VPC.

An interface VPC endpoint places elastic network interfaces (ENIs) with private IP addresses in the subnets, enabling secure and private connections to AWS services.

Configure the security groups.

Allow outbound HTTPS (TCP port 443) from the Lambda function's security group to the interface VPC endpoint's security group, and inbound HTTPS on the endpoint's security group from the Lambda function.

Security groups are stateful and must explicitly allow the necessary traffic to complete the PrivateLink network connection.

Key Concept

Configuring private access to AWS services via Interface VPC Endpoints (AWS PrivateLink) for resource-constrained architectures.

Estimated Time:2m 0s

Question 8Question →

A developer is deploying an AWS Lambda function inside a private subnet of a Virtual Private Cloud (VPC) to access an Amazon RDS database. The Lambda function also needs to connect to an external payment processor's public API over the internet. Which configuration should the developer use to allow the Lambda function to access the internet?

Configure a NAT Gateway in a public subnet, and add a route in the private subnet's route table that directs internet-bound traffic to the NAT Gateway.

Configure the Lambda function to run inside the private subnet without configuring a NAT Gateway or VPC endpoints, assuming the default subnet routing allows outbound internet traffic.

Modify the IAM execution role's trust policy of the Lambda function to permit direct public internet connections to external IP ranges.

Store the payment processor's API key in AWS Systems Manager Parameter Store and enable automatic rotation to open an internet-bound route.

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet, and add a route in the private subnet's route table that directs internet-bound traffic to the NAT Gateway.

Answer

Configure a NAT Gateway in a public subnet, and add a route in the private subnet's route table that directs internet-bound traffic to the NAT Gateway.

The correct option correctly states that a NAT Gateway must be configured in a public subnet and the private subnet's route table updated to direct destination

0.0.0.0/0

traffic to the NAT Gateway. This allows Lambda functions inside the private subnet to establish outbound connections to the internet without exposing them to inbound internet traffic.

Step-by-Step Solution

Identify that the Lambda function is running inside a private subnet and needs to connect to the public internet.

The Lambda function does not have a public IP address and cannot directly route traffic to an Internet Gateway.

AWS Lambda functions configured in a VPC are assigned private IP addresses only.

Select the appropriate network gateway that allows outbound-only internet access for private subnet resources.

Identify a NAT Gateway placed in a public subnet of the same VPC.

A NAT Gateway translates the private IP addresses of resources in private subnets to a public IP to communicate with the internet.

Update the routing table associated with the private subnet containing the Lambda function.

Add a route for

0.0.0.0/0

pointing to the NAT Gateway's ID.

This routes all non-VPC bound traffic (internet traffic) securely to the NAT Gateway.

Key Concept

VPC Routing and NAT Gateway for private subnet resources

Estimated Time:1m 0s

Question 9Question →

A developer has configured an AWS Lambda function to run inside the private subnets of a VPC so that it can securely query an Amazon RDS PostgreSQL DB instance. The Lambda function also needs to write application execution logs to an Amazon DynamoDB table. During testing, the Lambda function successfully queries the database but times out when trying to write to DynamoDB.

Which configuration change will resolve this connection issue in the most secure and cost-effective manner?

Move the Lambda function to the public subnets of the VPC and enable the public IP assignment setting in the VPC configuration.

Create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets.

Update the Lambda function's IAM execution role trust policy to allow the DynamoDB service principal to assume the role.

Store the DynamoDB connection metadata in AWS Secrets Manager instead of Systems Manager Parameter Store and configure automatic rotation.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets.

Answer

Create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets.

The correct answer is to create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets. A Gateway VPC Endpoint allows private subnets within a VPC to establish a secure, private connection to DynamoDB. The traffic remains within the AWS network, which avoids NAT Gateway processing fees, hourly charges, and the need for public IP addresses or internet routing, making it the most cost-effective and secure solution.

Step-by-Step Solution

Analyze the timeout error occurring during the DynamoDB call.

Determine that the Lambda function in the private subnet lacks a network route to public AWS services.

Lambda functions in private subnets cannot access public AWS endpoints directly without a NAT Gateway or a VPC Endpoint.

Compare connectivity options for accessing DynamoDB from the private subnet.

Identify that a Gateway VPC Endpoint is the most secure and cost-effective method to route traffic directly to DynamoDB.

VPC Endpoints route traffic over the private AWS network, avoiding the data transfer and hourly costs associated with NAT Gateways.

Configure the Gateway VPC Endpoint for DynamoDB.

Associate the endpoint with the route tables of the private subnets where the Lambda function resides.

Associating the endpoint adds the prefix list route to the subnet route tables, allowing traffic to DynamoDB to be routed through the endpoint.

Key Concept

VPC Endpoint configuration for secure and private access to AWS services from private subnets.

Estimated Time:1m 30s

Question 10Question →

An application is deployed on Amazon ECS using the AWS Fargate launch type within private subnets of a custom VPC. The application needs to securely establish a connection to an Amazon Aurora PostgreSQL database located in a database private subnet, using credentials that are automatically rotated. Additionally, the application must connect to an external third-party API on the public internet to process payments. Which configuration steps should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Deploy a NAT gateway in a public subnet, and add a route in the application's private subnet route table pointing 0.0.0.0/0 to the NAT gateway.

Update the security group of the Amazon Aurora database to allow inbound traffic on port 5432 from the security group attached to the ECS tasks.

Update the route table of the application's private subnets to route outbound traffic (0.0.0.0/0) directly to an Internet Gateway.

Modify the trust policy of the ECS task role to permit network traffic on port 5432 from the VPC CIDR block.

Save the database credentials in AWS Systems Manager Parameter Store and configure the built-in automatic rotation for the parameters.

Show answer & explanation

Answer: Deploy a NAT gateway in a public subnet, and add a route in the application's private subnet route table pointing 0.0.0.0/0 to the NAT gateway.; Update the security group of the Amazon Aurora database to allow inbound traffic on port 5432 from the security group attached to the ECS tasks.

Answer

The correct configurations are to deploy a NAT gateway in a public subnet and configure the application private subnet route table to point 0.0.0.0/0 traffic to it, and to update the database security group to permit inbound connections on port 5432 from the ECS task security group.

To allow private ECS Fargate tasks to reach the internet-facing payment API, a NAT Gateway is required in a public subnet with a corresponding route in the private subnet route table. To enable connectivity to the Aurora PostgreSQL database, the database's security group must permit inbound traffic on port 5432 from the security group assigned to the ECS tasks, ensuring only authorized tasks can connect.

Step-by-Step Solution

Determine the requirements for outbound internet access from private subnets.

Identify that AWS Fargate tasks running in private subnets cannot communicate directly with the internet. They require a NAT Gateway deployed in a public subnet with a corresponding route in the private subnet's route table pointing outbound traffic (0.0.0.0/0) to the NAT Gateway.

This configuration enables the tasks to connect to the external payment API while keeping them in private subnets.

Determine the requirements for secure database access within the VPC.

Configuring the security group of the target database to accept traffic on the database port from the source security group of the Fargate tasks.

Referencing security groups instead of IP ranges maintains dynamic, secure access and satisfies least-privilege security standards.

Evaluate the credentials rotation and identity configurations.

Identify that automatic secrets rotation is a feature of AWS Secrets Manager, not Systems Manager Parameter Store, and that IAM trust policies govern role assumption rather than network ports.

This rules out the invalid distractors targeting parameter storage and IAM configuration.

Key Concept

VPC security group referencing and private routing configurations for secure outbound and database traffic.

Question 11Question →

A developer is configuring an AWS Lambda function that runs inside a private subnet of a VPC. The Lambda function needs to connect to an Amazon RDS database in another private subnet and call an external third-party API over the public internet.

Which two network and security configurations are required to establish these connections?

Select all that apply

Configure the RDS security group to allow inbound traffic on the database port from the security group assigned to the Lambda function.

Route traffic destined for the internet (

0.0.0.0/0

) from the Lambda function's private subnet through a NAT Gateway located in a public subnet.

Add a route pointing to an Internet Gateway (

0.0.0.0/0

) directly in the route table of the Lambda function's private subnet.

Modify the Lambda execution role's IAM trust policy to grant the database connection permission.

Store the database credentials in AWS Systems Manager Parameter Store and enable automatic rotation of the parameter to secure the connection.

Show answer & explanation

Answer: Configure the RDS security group to allow inbound traffic on the database port from the security group assigned to the Lambda function.; Route traffic destined for the internet ( $0.0.0.0/0$ ) from the Lambda function's private subnet through a NAT Gateway located in a public subnet.

Answer

To establish the required connections, the RDS security group must be configured to allow inbound traffic on the database port from the Lambda function's security group, and a route to a NAT Gateway in a public subnet must be added to the private subnet's route table to allow outbound internet access for external API calls.

The correct configurations involve setting up an inbound security group rule on the RDS database that allows traffic from the Lambda function's security group, and routing internet-bound traffic from the private subnet to a NAT Gateway. This ensures the Lambda function can securely access the database inside the VPC and access external APIs over the internet.

Step-by-Step Solution

Configure database security group rules.

The RDS security group is updated to allow inbound traffic on the database port, referencing the security group of the Lambda function as the source.

This establishes secure, restricted communication between the Lambda function and the RDS database without opening the database to the entire subnet.

Configure private subnet routing for internet access.

A route for

0.0.0.0/0

is added to the private subnet's route table, pointing to a NAT Gateway in a public subnet.

Since the Lambda function is in a private subnet and does not have a public IP address, it cannot access the internet directly. Routing traffic through a NAT Gateway allows outbound-only internet access to call external APIs.

Key Concept

VPC security and connectivity configurations for AWS Lambda, involving Security Groups and NAT Gateways.

Question 12Question →

A developer is implementing a microservice using an AWS Lambda function that retrieves database credentials from AWS Secrets Manager and then connects to an Amazon RDS PostgreSQL database. The RDS database is hosted in private subnets within a VPC. To secure the database connection, the developer configures the Lambda function to run inside the same VPC and private subnets. However, during testing, the Lambda function execution times out during the SDK client initialization and call to Secrets Manager.

Which configuration change should the developer implement to resolve this issue while maintaining the most secure architecture?

Configure an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager within the private subnets, and configure the security groups to allow HTTPS traffic from the Lambda function to the endpoint.

Modify the Lambda function configuration to associate it with public subnets and enable public IP address assignment to allow it to communicate directly with the public endpoint of AWS Secrets Manager.

Update the trust policy of the Lambda function's IAM execution role to trust the AWS Secrets Manager service principal (secretsmanager.amazonaws.com), allowing it to push credentials to the execution environment.

Migrate the database credentials from AWS Secrets Manager to the AWS Systems Manager Parameter Store as a SecureString, since Parameter Store is natively accessible within private subnets without additional routing configurations.

Show answer & explanation

Answer: Configure an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager within the private subnets, and configure the security groups to allow HTTPS traffic from the Lambda function to the endpoint.

Answer

The correct configuration is to create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnets. This registers Elastic Network Interfaces (ENIs) with private IP addresses in the VPC subnets that route traffic directly to AWS Secrets Manager over the AWS internal network. By allowing outbound HTTPS (port

443

) from the Lambda function's security group to the VPC endpoint's security group, the Lambda function can resolve the endpoint privately and securely retrieve the database credentials.

Step-by-Step Solution

Analyze the network path of the Lambda function running inside the private VPC subnets.

The Lambda function has access to VPC resources (like the RDS database) but lacks direct access to the public internet because there is no NAT Gateway or internet gateway routing in the private route table.

By default, AWS service endpoints like AWS Secrets Manager are public, requiring internet access or a private endpoint to connect from within a VPC.

Determine the most secure method to access AWS Secrets Manager without routing traffic over the public internet.

Identify that AWS PrivateLink allows creating Interface VPC Endpoints inside the VPC subnets.

VPC Endpoints provide private, secure access to AWS services by assigning private IP addresses from the VPC subnets directly to the endpoint.

Configure the security groups for both the Lambda function and the Interface VPC Endpoint.

The Lambda function's security group must allow outbound HTTPS (port

443

) to the VPC endpoint, and the VPC endpoint's security group must allow inbound HTTPS (port

443

) from the Lambda function.

Security groups are stateful and must explicitly allow the necessary traffic directions to establish the TCP connection.

Key Concept

VPC Endpoints (AWS PrivateLink) enable private connectivity between VPC resources and supported AWS services without internet traversal.

Estimated Time:2m 0s

Question 13Question →

A developer is implementing an AWS Lambda function that must query an Amazon Aurora PostgreSQL database located in a private VPC subnet. Additionally, the Lambda function must retrieve database credentials from AWS Secrets Manager and send HTTP POST requests to an external API endpoint over the public internet.

Which network and security configuration should the developer implement to meet these requirements securely while adhering to the principle of least privilege?

Deploy the Lambda function in the private subnets. Associate a security group with the Lambda function that allows outbound TCP traffic on port

5432

to the database security group and outbound HTTPS traffic on port

443

. Configure the private subnets' route table to route

0.0.0.0/0

traffic to a NAT Gateway located in a public subnet. Configure the database security group to allow inbound traffic on port

5432

only from the Lambda function's security group.

Deploy the Lambda function in the private subnets. Associate a security group with the Lambda function that allows outbound TCP traffic on port

5432

to the database security group and outbound HTTPS traffic on port

443

. Configure the private subnets' route table to route

0.0.0.0/0

traffic directly to the Internet Gateway. Configure the database security group to allow inbound traffic on port

5432

only from the Lambda function's security group.

Deploy the Lambda function in the public subnets to ensure it has native internet access to reach Secrets Manager and the external API. Store the database credentials in Systems Manager Parameter Store as a standard String parameter. Configure the database security group to allow inbound traffic on port

5432

from the public subnet CIDR blocks.

Deploy the Lambda function in the private subnets. Configure the database security group to allow inbound traffic on port

5432

from

0.0.0.0/0

. Attach an IAM policy to the Lambda execution role that allows the `sts:AssumeRole` action on the database, and modify the database's IAM trust policy to trust the Lambda function's execution role.

Show answer & explanation

Answer: Deploy the Lambda function in the private subnets. Associate a security group with the Lambda function that allows outbound TCP traffic on port $5432$ to the database security group and outbound HTTPS traffic on port $443$ . Configure the private subnets' route table to route $0.0.0.0/0$ traffic to a NAT Gateway located in a public subnet. Configure the database security group to allow inbound traffic on port $5432$ only from the Lambda function's security group.

Answer

Deploy the Lambda function in the private subnets, configure a NAT Gateway in a public subnet to route

0.0.0.0/0

traffic, and associate a security group with the Aurora database that allows inbound traffic on port

5432

only from the Lambda security group.

The correct network configuration places both the Lambda function and the database in private subnets. Outbound internet access for the Lambda function (to access the external payment gateway and public Secrets Manager endpoints) is enabled by routing

0.0.0.0/0

traffic through a NAT Gateway in a public subnet. Database access is securely restricted at the network layer by configuring the database's security group to allow inbound connections on port

5432

only from the Lambda function's security group.

Step-by-Step Solution

Determine the placement of the Lambda function and the database.

Both resources are placed inside private VPC subnets to isolate them from direct public internet exposure.

This is required to protect the database and application layer in accordance with the AWS Well-Architected Framework.

Provide outbound internet connectivity for the Lambda function.

Route the private subnets'

0.0.0.0/0

traffic to a NAT Gateway situated in a public subnet.

The Lambda function needs internet access to communicate with the external API and public endpoints for Secrets Manager, but it lacks public IP addresses itself.

Configure the security groups for secure, localized communication.

Allow outbound port

5432

and port

443

traffic on the Lambda security group, and configure the database security group to allow inbound port

5432

traffic only when originating from the Lambda security group.

This implements the principle of least privilege by strictly restricting database access to the Lambda function at the network layer.

Key Concept

AWS Lambda VPC networking, Security Group referencing, and NAT Gateway routing for private-to-public subnet communication.

Question 14Question →

A containerized microservice deployed on AWS Fargate inside a private VPC subnet needs to write transaction logs to an Amazon DynamoDB table and send real-time confirmation callbacks to an external payment processor at $198.51.100.50/32$ . According to company security requirements, all database traffic must remain within the AWS network, and outbound traffic from the Fargate container must be restricted to only the payment processor and the DynamoDB service. Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Create a Gateway VPC Endpoint for DynamoDB, and associate it with the route table of the private subnet.

Configure the Fargate security group with outbound rules allowing HTTPS traffic on port

443

198.51.100.50/32

and to the AWS-managed prefix list representing DynamoDB.

Deploy an AWS Lambda function inside the private subnet to proxy payment requests to the external API, and configure the Fargate tasks to invoke this function.

Modify the trust policy of the Fargate task execution role to allow the VPC's NAT Gateway to assume the role, enabling secure outbound internet routing.

Store the payment API credentials in Systems Manager Parameter Store with automatic rotation enabled, and configure the task definition to retrieve them.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for DynamoDB, and associate it with the route table of the private subnet.; Configure the Fargate security group with outbound rules allowing HTTPS traffic on port $443$ to $198.51.100.50/32$ and to the AWS-managed prefix list representing DynamoDB.

Answer

Create a Gateway VPC Endpoint for DynamoDB associated with the private subnet's route table, and configure the Fargate security group with outbound rules allowing HTTPS traffic to the payment processor IP address and to the AWS-managed prefix list representing DynamoDB.

To secure DynamoDB traffic, a Gateway VPC Endpoint is created and associated with the private subnet's route table, which routes traffic to the service privately. To satisfy outbound restrictions, the Fargate task's security group is configured with egress rules allowing HTTPS traffic to the specific external payment processor IP address and to the AWS-managed prefix list representing DynamoDB.

Step-by-Step Solution

Create a Gateway VPC Endpoint for Amazon DynamoDB.

A gateway endpoint is provisioned in the VPC, associated with an AWS-managed prefix list representing DynamoDB.

Allows private connectivity to DynamoDB within the AWS network.

Associate the Gateway VPC Endpoint with the route table of the private subnet where Fargate runs.

The route table is updated with a route directing traffic for the DynamoDB prefix list to the Gateway VPC Endpoint.

Ensures that the private subnet's routing logic forwards database-bound requests directly to the endpoint.

Define outbound rules on the Fargate service security group.

An egress rule allows HTTPS (port

443

) traffic to destination

198.51.100.50/32

, and another egress rule allows traffic to the DynamoDB prefix list.

Enforces strict network boundaries, allowing outbound connections only to the payment processor and DynamoDB.

Key Concept

VPC Gateway Endpoints and security group prefix lists are used to route and restrict outbound traffic from private resources to specific AWS services and external targets.

Estimated Time:3m 0s

Question 15Question →

A backend system executes inside private subnets of a VPC to process financial transactions. This workload requires outbound connections to both an internal database within the VPC and a public third-party banking API. The database traffic is successful, but all connection attempts to the public API timeout. Which network configuration will enable the workload to connect to the external API?

Provision a NAT Gateway within a subnet that has a route to an Internet Gateway, and update the workload's subnet route table to direct destination 0.0.0.0/0 traffic to the NAT Gateway.

Establish an AWS PrivateLink VPC endpoint for the third-party banking API, and configure the private subnet's route table to route external traffic to the endpoint.

Modify the IAM execution role's trust policy to trust the public banking API's domain, allowing secure cross-account API calls to bypass the VPC boundary.

Store the public banking API's domain IP addresses in Systems Manager Parameter Store, and enable automatic key rotation to dynamically update the subnet's network access control lists (NACLs).

Show answer & explanation

Answer: Provision a NAT Gateway within a subnet that has a route to an Internet Gateway, and update the workload's subnet route table to direct destination 0.0.0.0/0 traffic to the NAT Gateway.

Answer

Provision a NAT Gateway within a subnet that has a route to an Internet Gateway, and update the workload's subnet route table to direct destination 0.0.0.0/0 traffic to the NAT Gateway.

Providing a NAT Gateway in a public subnet and configuring the private subnet's route table to target it for all external traffic (0.0.0.0/0) allows resources within the private subnet to securely initiate outbound connections to the internet, resolving the timeout issue to the public banking API.

Step-by-Step Solution

Identify the destination type for the failing connections.

The failing traffic is destined for a public third-party banking API, which resides on the public internet.

Traffic to public internet endpoints from a private subnet requires a NAT mechanism since the private subnet lacks public IP addresses and direct internet routes.

Determine the appropriate NAT deployment architecture.

A NAT Gateway must be placed in a public subnet (a subnet with a route to an Internet Gateway).

NAT Gateways translate private source IPs to a public IP and route the traffic to the Internet Gateway.

Configure the private subnet routing.

Add a route to the private subnet's route table with destination 0.0.0.0/0 pointing to the NAT Gateway.

This directs all non-VPC bound traffic (internet traffic) through the NAT Gateway for translation and outbound delivery.

Key Concept

Outbound internet connectivity from private VPC subnets using a NAT Gateway

Question 16Question →

An engineering team is troubleshooting a newly deployed backend application hosted in a private subnet of a custom VPC. The application needs to retrieve objects from an Amazon S3 bucket and send messages to an Amazon SQS queue. The VPC has no Internet Gateway or NAT Gateway. The developer creates an Amazon S3 Gateway Endpoint and an Amazon SQS Interface Endpoint. However, the application is still experiencing connection timeouts when trying to access these services. Which of the following configuration changes must the developer make to resolve this issue? (Select TWO.)

Select all that apply

Verify that the route table associated with the private subnet contains an entry that directs traffic for S3 to the Gateway Endpoint.

Ensure the security group associated with the SQS Interface Endpoint allows inbound HTTPS (TCP port

443

) traffic from the application's security group.

Associate the route table of the public subnet with the S3 Gateway Endpoint, and add a route pointing to the SQS Interface Endpoint in the private subnet's route table.

Store the VPC endpoint DNS names in AWS Secrets Manager and configure a scheduled rotation to refresh the endpoint connections hourly.

Modify the trust policy of the application's IAM execution role to trust the VPC Endpoint service principal vpce.amazonaws.com.

Show answer & explanation

Answer: Verify that the route table associated with the private subnet contains an entry that directs traffic for S3 to the Gateway Endpoint.; Ensure the security group associated with the SQS Interface Endpoint allows inbound HTTPS (TCP port $443$ ) traffic from the application's security group.

Answer

Verify that the route table associated with the private subnet contains an entry directing S3 traffic to the Gateway Endpoint, and ensure that the security group of the SQS Interface Endpoint allows inbound HTTPS traffic from the application's security group.

For the Gateway Endpoint to route traffic to Amazon S3 from the private subnet, the subnet's route table must contain an entry directing S3 traffic to the S3 Gateway Endpoint. For the Interface Endpoint (PrivateLink) to route SQS traffic, the application connects to the endpoint's Elastic Network Interface (ENI) private IPs, which requires the security group attached to the SQS Interface Endpoint to allow inbound HTTPS (TCP port

443

) traffic from the application's security group.

Step-by-Step Solution

Evaluate Gateway Endpoint configuration requirements.

Confirm that Gateway Endpoints (like Amazon S3) require route table entries in the private subnet's route table pointing to the gateway endpoint (`vpce-xxx`) to correctly route traffic.

Without route table updates, traffic destined for S3 will attempt to use the default route, which fails since there is no internet gateway or NAT gateway.

Evaluate Interface Endpoint configuration requirements.

Confirm that Interface Endpoints (like Amazon SQS) provision ENIs in the private subnet and rely on security groups to allow inbound HTTPS (TCP port

443

) traffic from the client.

Because Interface Endpoints use private IP addresses within the VPC, the security group of the endpoint must allow inbound traffic from the application's security group.

Rule out non-network configurations.

Identify that IAM execution roles, trust policies, and AWS Secrets Manager configurations do not resolve TCP connection timeouts.

Connection timeouts represent network layer blocks or routing failures, not IAM permission denials or credential management issues.

Key Concept

Configuring VPC endpoints (Gateway and Interface) and their respective route tables and security groups to allow secure, private access to AWS services.

Estimated Time:2m 30s

Question 17Question →

An organization is deploying a secure microservice where an AWS Lambda function is configured to run inside a private subnet of a custom VPC. The function must retrieve database credentials from AWS Secrets Manager and query an Amazon DynamoDB table. To meet strict security standards, no traffic is allowed to traverse the public internet. The developer has created a gateway VPC endpoint for DynamoDB and an interface VPC endpoint for Secrets Manager in the same private subnet. While DynamoDB queries succeed, the Lambda function times out when attempting to retrieve credentials from Secrets Manager. Which action must the developer take to allow the Lambda function to successfully retrieve the secrets?

Move the Lambda function to a public subnet within the VPC and assign a public IP address to its execution configuration to allow direct routing to the public Secrets Manager endpoint.

Update the trust policy of the Lambda execution role to trust the interface VPC endpoint service principal, allowing the network interface to assume the role's permissions.

Configure the security group attached to the Secrets Manager interface VPC endpoint to allow inbound TCP port 443 traffic from the security group attached to the Lambda function.

Migrate the database credentials from AWS Secrets Manager to Systems Manager Parameter Store and provision a gateway VPC endpoint for Parameter Store.

Show answer & explanation

Answer: Configure the security group attached to the Secrets Manager interface VPC endpoint to allow inbound TCP port 443 traffic from the security group attached to the Lambda function.

Answer

Configure the security group attached to the Secrets Manager interface VPC endpoint to allow inbound TCP port 443 traffic from the security group attached to the Lambda function.

The correct option correctly configures the security group associated with the Secrets Manager interface VPC endpoint. Interface endpoints (PrivateLink) create network interfaces inside the VPC with private IP addresses. For the Lambda function to reach these network interfaces over HTTPS, the security group of the interface endpoint must allow inbound traffic on TCP port 443 from the security group of the Lambda function.

Step-by-Step Solution

Analyze the network path and failure point.

The Lambda function times out when attempting to connect to Secrets Manager. Because there is no NAT Gateway or internet path, traffic must route through the interface VPC endpoint.

Since the DynamoDB query succeeds via the gateway endpoint, the Lambda function's internal VPC subnet configuration and basic execution routing are functional, indicating a specific block on the Secrets Manager interface endpoint path.

Identify the network requirements for interface VPC endpoints.

Interface endpoints (AWS PrivateLink) deploy ENIs inside the VPC. Clients connect to these ENIs using HTTPS on TCP port 443.

Unlike gateway endpoints, interface endpoints act as local network interfaces in the subnet and are subject to security group evaluation.

Configure the endpoint security group rules.

Add an inbound rule to the security group associated with the Secrets Manager interface VPC endpoint allowing TCP port 443 traffic from the Lambda function's security group.

This permits the Lambda function's network interface to successfully initiate and complete the TLS handshake with the Secrets Manager endpoint ENIs.

Key Concept

Security group configuration for interface VPC endpoints

Question 18Question →

An application runs on an Amazon EC2 instance located within a private subnet of a Virtual Private Cloud (VPC). The application must access AWS Systems Manager Parameter Store to retrieve configuration parameters. The security policy dictates that this traffic must not traverse the public internet. Which VPC configuration should be implemented to satisfy this requirement?

Create an interface VPC endpoint for Systems Manager within the VPC.

Configure a NAT Gateway in a public subnet and route all internet-bound traffic from the private subnet through it.

Update the IAM role trust policy on the EC2 instance to trust the Systems Manager service principal.

Migrate the parameters to AWS Secrets Manager and enable automatic credential rotation.

Show answer & explanation

Answer: Create an interface VPC endpoint for Systems Manager within the VPC.

Answer

Create an interface VPC endpoint for Systems Manager within the VPC.

Creating an interface VPC endpoint for Systems Manager within the VPC is the correct solution. Interface VPC endpoints use AWS PrivateLink, which places elastic network interfaces (ENIs) with private IP addresses in the subnets. Traffic to Systems Manager is routed privately within the AWS network, satisfying the requirement to avoid the public internet.

Step-by-Step Solution

Identify the environment and target service requirements.

An application on an EC2 instance in a private subnet needs to access AWS Systems Manager Parameter Store.

This establishes the source and destination for the network traffic.

Apply the security constraint regarding internet traversal.

The traffic must remain entirely within the AWS network and cannot route through the public internet.

This eliminates options that route traffic through internet gateways or NAT gateways to public service endpoints.

Select the VPC private connectivity option for AWS services.

An interface VPC endpoint (powered by AWS PrivateLink) is configured for Systems Manager, providing private IP addresses within the VPC.

Interface VPC endpoints allow private subnets to communicate with AWS services securely without using public endpoints.

Key Concept

AWS PrivateLink and Interface VPC Endpoints allow private resources inside a VPC to securely connect to supported AWS services without internet traversal.

Question 19Question →

A serverless application needs to retrieve credentials from AWS Secrets Manager and query an Amazon RDS database located in a private VPC subnet. What network configuration should be implemented to allow the Lambda function to securely retrieve the credentials and access the database without exposing any traffic to the public internet?

Run the Lambda function in the private VPC subnets without any VPC endpoints or NAT gateways, as Lambda functions automatically bypass VPC routing to connect to public AWS service endpoints.

Store the database credentials in AWS Systems Manager Parameter Store and enable automatic rotation to allow the private Lambda function to retrieve them over standard HTTP.

Attach the Lambda function to the private VPC subnets, configure an interface VPC endpoint for Secrets Manager, and permit inbound database security group traffic from the Lambda function's security group.

Modify the Lambda function's IAM role trust policy to allow public internet gateway access for database credentials validation.

Show answer & explanation

Answer: Attach the Lambda function to the private VPC subnets, configure an interface VPC endpoint for Secrets Manager, and permit inbound database security group traffic from the Lambda function's security group.

Answer

The correct configuration is to attach the Lambda function to the private subnets, set up an interface VPC endpoint for Secrets Manager to allow private API calls, and configure the RDS database's security group to allow inbound traffic from the Lambda function's security group. This achieves fully private, secure access for both credentials retrieval and database queries.

Step-by-Step Solution

Configure the Lambda function to run inside the private subnets of the VPC.

The Lambda function gains private network access to VPC resources, including the RDS database in the same VPC.

This establishes private network routing to the database.

Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager inside the VPC.

A private network interface is placed in the subnets, routing traffic to Secrets Manager privately.

This allows the Lambda function to retrieve secrets without traversing the public internet.

Modify the RDS database's security group inbound rules to allow traffic on the database port from the Lambda function's security group.

The RDS database will accept connection requests initiated by the Lambda function.

This ensures secure access to the database using the principle of least privilege.

Key Concept

VPC endpoints and security groups for private AWS service and database connectivity from Lambda functions.

Question 20Question →

A developer is deploying a containerized API on AWS Fargate within a private subnet of a custom VPC. The API needs to read and write data to an Amazon Aurora PostgreSQL database located in a different private subnet within the same VPC. Additionally, the API must fetch sensitive API keys from AWS Secrets Manager. There is no route to the internet or any NAT Gateway configured in the VPC. Which set of configurations is required to establish these connections securely?

Create an interface VPC endpoint (AWS PrivateLink) for Secrets Manager, configure its security group to allow inbound HTTPS traffic from the Fargate task, and configure the Aurora security group to allow inbound PostgreSQL traffic from the Fargate task's security group.

Deploy a NAT Gateway in the Fargate task's private subnet, add a route in its route table pointing 0.0.0.0/0 to the NAT Gateway, and configure the Aurora security group to allow inbound traffic from the NAT Gateway's private IP address.

Modify the IAM trust policy of the ECS task execution role to trust secretsmanager.amazonaws.com and add a policy allowing secretsmanager:GetSecretValue, then configure the Aurora routing table to propagate routes from the Fargate subnet.

Migrate the API keys from AWS Secrets Manager to Systems Manager Parameter Store, as Parameter Store is natively accessible within private subnets without requiring VPC endpoints or NAT gateways, and open port 5432 on the Aurora subnet's Network Access Control List (NACL) for inbound and outbound traffic.

Show answer & explanation

Answer: Create an interface VPC endpoint (AWS PrivateLink) for Secrets Manager, configure its security group to allow inbound HTTPS traffic from the Fargate task, and configure the Aurora security group to allow inbound PostgreSQL traffic from the Fargate task's security group.

Answer

The correct option establishes a private, secure path to Secrets Manager via AWS PrivateLink within the VPC, and allows the Fargate task to securely communicate with the Aurora database in another private subnet of the same VPC using security groups.

Step-by-Step Solution

Analyze destination endpoints.

Amazon Aurora PostgreSQL is hosted within the VPC, while AWS Secrets Manager is a public AWS service endpoint outside the VPC.

This determines which connections require VPC-native routing and which require external access or endpoints.

Configure the database connection.

The Aurora security group is modified to allow inbound traffic on port 5432 originating from the security group of the Fargate task.

Since both resources reside in different private subnets of the same VPC, local routing is automatic, and security groups are used to restrict access.

Configure access to AWS Secrets Manager without internet access.

An interface VPC endpoint (PrivateLink) for Secrets Manager is created in the VPC subnets, and its security group is set to allow inbound HTTPS traffic (port 443) from the Fargate task's security group.

Since there is no internet route or NAT Gateway, a VPC endpoint is required to establish private connectivity to Secrets Manager.

Key Concept

VPC Security Groups and Private VPC Endpoints

Estimated Time:2m 0s

Page 1 / 2Next

VPC Security for Developers

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept