Examkin

Question

Difficulty: HardModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A logistics company is modernizing a retail stock allocation API. The API is hosted on AWS using Amazon API Gateway and AWS Lambda, and must securely interact with an Amazon Aurora PostgreSQL database located in a private subnet. The application experiences extreme traffic spikes during promotions, increasing from 50 to 10,000 requests per second. The security policy requires database credentials to be stored in AWS Secrets Manager, encrypted using a customer-managed KMS key to allow granular access control via key policies. The network architecture must be highly available, minimize exposure to the public internet, and prevent database connection exhaustion. Which of the following architectures meets these requirements with the highest availability and security?

  1. A
    Configure a regional API Gateway. Deploy Amazon RDS Proxy in the database subnets. Configure the Lambda function to run in the private subnets of the VPC across multiple Availability Zones, and configure VPC endpoints for AWS Secrets Manager and KMS. Store the database credentials in AWS Secrets Manager, encrypted with the default AWS-managed key aws/secretsmanager for Secrets Manager, and set a reserved concurrency limit on the Lambda function.
  2. B
    Configure a regional API Gateway. Deploy Amazon RDS Proxy in the database subnets. Configure the Lambda function to run in the private subnets of the VPC across multiple Availability Zones. Configure the VPC route tables to direct all outbound traffic to Secrets Manager and KMS through a single NAT Gateway deployed in a single public subnet. Store the database credentials in AWS Secrets Manager, encrypted with a customer-managed KMS key, and set a reserved concurrency limit on the Lambda function.
  3. Configure a regional API Gateway. Deploy Amazon RDS Proxy in the database subnets. Configure the Lambda function to run in the private subnets of the VPC across multiple Availability Zones, and configure VPC endpoints for AWS Secrets Manager and KMS. Store the database credentials in AWS Secrets Manager, encrypted with a customer-managed KMS key, and set a reserved concurrency limit on the Lambda function.Answer
  4. D
    Configure a regional API Gateway. Deploy Amazon RDS Proxy in the database subnets. Configure the Lambda function to run in the private subnets of the VPC across multiple Availability Zones, and configure VPC endpoints for AWS Secrets Manager and KMS. Store the database credentials in AWS Secrets Manager, encrypted with a customer-managed KMS key, and allow the Lambda function to use unreserved concurrency to handle scaling during promotional spikes.

Answer

Configure a regional API Gateway, deploy Amazon RDS Proxy in the database subnets, run the Lambda function in the private subnets of the VPC across multiple Availability Zones with VPC endpoints for AWS Secrets Manager and KMS, encrypt the secret with a customer-managed KMS key, and configure reserved concurrency on the Lambda function.
The correct architecture uses Amazon RDS Proxy to handle connection pooling for the database, runs the Lambda function within the VPC using interface VPC endpoints to securely retrieve secrets and decrypt them without internet egress, utilizes a customer-managed KMS key to support explicit key policy configuration, and configures reserved concurrency on the Lambda function to protect the regional execution pool.

Step-by-Step Solution

1
Address database connection pooling for massive spikes.
Amazon RDS Proxy is deployed in the database subnets to pool connections and prevent database exhaustion.
Sudden traffic spikes from 50 to 10,000 requests per second can easily overwhelm a relational database with connection establishment overhead.
2
Establish secure private network pathways to AWS Secrets Manager and KMS.
Interface VPC endpoints (AWS PrivateLink) are created for Secrets Manager and KMS within the VPC.
This keeps traffic within the AWS private network and avoids the latency, cost, and reliability risks of traversing the public internet via NAT Gateways.
3
Configure encryption keys with custom permissions control.
A Customer Managed Key (CMK) is used to encrypt the Secrets Manager secret.
Unlike default AWS-managed keys (e.g., aws/secretsmanager), Customer Managed Keys allow modification of the key policy to enforce strict decryption access limits for the Lambda function's execution role.
4
Protect regional concurrency limits.
Reserved concurrency is set on the Lambda function.
Restricting the function's maximum concurrency prevents it from consuming the entire unreserved concurrency pool of the regional AWS account, which would throttle other critical applications.

Key Concept

Combining Lambda VPC integration, RDS Proxy connection pooling, PrivateLink endpoints, customer-managed KMS key policies, and Lambda concurrency management to build secure, highly available serverless workloads.
Estimated Time:3m 0s
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic