Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A healthcare organization is modernizing its on-premises patient registration system by migrating to a serverless architecture on AWS. The application will expose an internal API to multiple business partners operating in separate AWS accounts within the same AWS Organization.

The new architecture uses Amazon API Gateway private REST APIs and AWS Lambda functions that retrieve data from an Amazon Aurora PostgreSQL database.

The architecture must satisfy the following requirements:
- The API must only be accessible over private connections from the partners' VPCs.
- The API Gateway endpoint must resolve using the default private DNS hostnames, and cross-account DNS resolution must be functional.
- The Lambda functions must handle sudden bursts in registration requests without exhausting the database connection pool or throttling other critical workloads in the host account.

Which TWO configurations must a solutions architect implement to satisfy these requirements? (Select TWO.)

  1. A
    Configure the Lambda functions with unreserved concurrency to allow unlimited scaling, and deploy Amazon Aurora Read Replicas to handle the increase in database connection requests.
  2. Create Amazon RDS Proxy between the Lambda functions and the Aurora database, and configure reserved concurrency on the registration Lambda functions.Answer
  3. C
    Enable AWS-managed KMS keys for encrypting Lambda environment variables, and grant the partner IAM roles cross-account permission to decrypt using the key policy of the default aws/lambda key.
  4. D
    Deploy an API Gateway private REST API, and rely on the default public API Gateway DNS name to route traffic privately from the partner VPCs without associating any Route 53 Private Hosted Zones.
  5. Create an interface VPC endpoint for API Gateway in each partner VPC, associate the host account's Route 53 Private Hosted Zone with the partner VPCs, and apply an API Gateway resource policy allowing access from the VPC endpoints.Answer

Answer

The correct configurations are to deploy Amazon RDS Proxy with reserved concurrency for the Lambda functions, and to establish cross-account private API access by creating interface VPC endpoints in the partner VPCs, associating the Route 53 Private Hosted Zone with the partner VPCs, and using an API Gateway resource policy.
Implementing Amazon RDS Proxy and Lambda reserved concurrency manages scaling behavior safely without overloading the database or exhausting the host account's shared regional concurrency. Creating interface VPC endpoints, associating the Route 53 Private Hosted Zone cross-account, and implementing resource policies allows secure, private DNS resolution and traffic routing across organizational boundaries.

Step-by-Step Solution

1
Analyze database connection limits and concurrency impacts.
Identify that sudden bursts of Lambda invocations will deplete Aurora's connection pool. Setting up Amazon RDS Proxy handles connection pooling, while reserved concurrency limits the maximum resource utilization of the Lambda function to protect the host account's other functions.
Ensures database availability under peak loads and maintains operational isolation for neighboring serverless workloads.
2
Design the private cross-account API Gateway integration.
Determine that private APIs require interface VPC endpoints in the client (partner) VPCs. To resolve DNS queries correctly across accounts, the Route 53 Private Hosted Zone in the host account must be explicitly associated with the partner VPCs.
Allows private network traffic to transit to the API Gateway without traversing the public internet, satisfying the private connectivity and DNS requirements.
3
Secure the private API Gateway endpoints.
Apply an API Gateway resource policy to the private REST API that explicitly allows the Action 'execute-api:Invoke' from the partner's VPC endpoints.
Restricts access to authorized VPC endpoints and prevents unauthorized entities from reaching the private endpoints.

Key Concept

Deploying cross-account private serverless APIs using API Gateway private REST endpoints, Route 53 Private Hosted Zones, and RDS Proxy with Lambda concurrency management.
Estimated Time:2m 0s
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic