Examkin

Question

Difficulty: HardModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A media broadcasting company is modernizing its user subscription metadata API by refactoring a legacy application into a serverless architecture on AWS. The new system will use Amazon API Gateway and AWS Lambda to query an Amazon RDS PostgreSQL database. The database resides in private VPC subnets. The Lambda function must also make outbound HTTPS calls to an external partner's payment gateway. The migration has the following requirements:

* The database must be protected against connection exhaustion during high-traffic broadcast events.
* High availability must be maintained for all outbound external payments API calls.
* The subscription API function must not impact other critical serverless workloads in the same AWS account by exhausting the regional concurrency limit during peak events.
* All environment variables containing sensitive database credentials must be encrypted using an AWS KMS key that supports custom key policies for auditing by an external security team's AWS account.

Which configuration should a Solutions Architect recommend?

  1. A
    Deploy Amazon RDS Proxy in the database VPC to manage connection pooling. Configure the Lambda function to run inside the VPC's private subnets, and deploy NAT Gateways in multiple Availability Zones. Configure Provisioned Concurrency for the Lambda function without setting a Reserved Concurrency limit, and encrypt environment variables using a Customer Managed Key with a key policy allowing cross-account access.
  2. Deploy Amazon RDS Proxy in the database VPC to manage connection pooling. Configure the Lambda function to run inside the VPC's private subnets, and deploy NAT Gateways in multiple Availability Zones to provide redundant outbound paths for external payment calls. Configure Reserved Concurrency for the Lambda function, and encrypt environment variables using a Customer Managed Key with a key policy that allows cross-account read access to the auditing team.Answer
  3. C
    Deploy Amazon RDS Proxy in the database VPC to manage connection pooling. Configure the Lambda function to run inside the VPC's private subnets, and deploy a single NAT Gateway in a public subnet to route outbound payment calls to the internet. Configure Reserved Concurrency for the Lambda function, and encrypt environment variables using a Customer Managed Key with a key policy that allows cross-account access.
  4. D
    Deploy Amazon RDS Proxy in the database VPC to manage connection pooling. Configure the Lambda function to run inside the VPC's private subnets, and deploy NAT Gateways in multiple Availability Zones. Configure Reserved Concurrency for the Lambda function, and encrypt environment variables using the default AWS-managed KMS key (aws/lambda) while adding the auditing team's AWS account role to the key policy.

Answer

Deploy Amazon RDS Proxy, place the Lambda function in private subnets with NAT Gateways in multiple Availability Zones, configure Reserved Concurrency on the function, and encrypt sensitive environment variables using a Customer Managed Key.
Deploying Amazon RDS Proxy handles connection pooling to protect the PostgreSQL database. Running the Lambda function in the VPC's private subnets and routing outbound internet traffic through multiple NAT Gateways ensures high availability for the external payment gateway calls. Setting Reserved Concurrency limits the maximum concurrent executions for this specific function, preventing it from consuming the entire regional pool and starving other functions in the account. Using a Customer Managed Key (CMK) allows the key policy to be customized, facilitating auditing access for the external security team's AWS account.

Step-by-Step Solution

1
Configure database connection management
Deploy Amazon RDS Proxy in the database VPC.
RDS Proxy pools and shares database connections to prevent the PostgreSQL database from running out of connections during traffic spikes.
2
Configure Lambda network routing and high availability for outbound traffic
Place Lambda in private subnets and deploy NAT Gateways in multiple Availability Zones.
Lambda functions in private subnets require NAT Gateways to access the external payment gateway over the internet. Multiple NAT Gateways ensure high availability across Availability Zones.
3
Enforce concurrency boundaries
Configure Reserved Concurrency on the subscription API Lambda function.
Reserved Concurrency guarantees a maximum limit of concurrent executions for the function, protecting the remaining regional concurrency pool for other serverless applications in the AWS account.
4
Configure encryption key policies for cross-account auditing
Create a Customer Managed Key in AWS KMS and associate it with the Lambda environment variables.
Customer Managed Keys allow key policy customization to grant cross-account read access, which is not supported by default AWS-managed KMS keys.

Key Concept

Designing highly available, secure, and resilient serverless architectures using Lambda, API Gateway, RDS Proxy, and custom KMS keys.
Estimated Time:2m 30s
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic