Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A company is modernizing a legacy financial ledger processing application. The application must receive ledger transaction payloads from an on-premises network over an AWS Direct Connect connection and process them using a private serverless backend on AWS. The solutions architect designs the backend using Amazon API Gateway and AWS Lambda. The Lambda functions must store processed transactions in an Amazon Aurora PostgreSQL database. The backend must be completely isolated from the public internet, and access to the API must be restricted to authorized internal corporate applications. Which TWO configurations should the solutions architect implement to meet these requirements?

  1. Configure a private API Gateway with an interface VPC endpoint in the VPC, and apply an API Gateway resource policy that restricts access to the VPC endpoint ID.Answer
  2. Configure the Lambda functions to run within the private subnets of the VPC, and establish connection pooling by deploying an Amazon RDS Proxy between the Lambda functions and the Aurora PostgreSQL database.Answer
  3. C
    Configure the Lambda functions with unlimited unreserved concurrency to guarantee the function can dynamically scale to process any sudden burst of ledger transactions.
  4. D
    Configure the Lambda functions to route all outbound database-bound traffic through a single NAT Gateway deployed in a single Availability Zone.
  5. E
    Encrypt sensitive transaction payloads using the default AWS-managed KMS key (aws/lambda), and modify its key policy to allow cross-account decryption access for partner services.

Answer

Configure a private API Gateway with an interface VPC endpoint in the VPC, and apply an API Gateway resource policy that restricts access to the VPC endpoint ID. Additionally, configure the Lambda functions to run within the private subnets of the VPC, and establish connection pooling by deploying an Amazon RDS Proxy between the Lambda functions and the Aurora PostgreSQL database.
The correct options configure a secure, private, and resilient path. By utilizing a private API Gateway with an interface VPC endpoint and an API Gateway resource policy, incoming API requests are isolated from the public internet. Deploying AWS Lambda in the private subnets of the VPC allows secure connectivity to Aurora PostgreSQL, while Amazon RDS Proxy manages database connection pooling to handle serverless scale without exhausting database connections.

Step-by-Step Solution

1
Establish private and authorized API endpoints.
Deploy Amazon API Gateway as a private API, configure an interface VPC endpoint, and attach a resource policy restricting access to the VPC endpoint.
This prevents public internet access to the API and secures traffic from on-premises clients crossing the Direct Connect path.
2
Integrate compute into the private network.
Configure the AWS Lambda functions with VPC execution roles and map them to private subnets.
This allows the functions to securely access database resources inside the private VPC without crossing the public internet.
3
Manage database connection pressure.
Deploy an Amazon RDS Proxy in the VPC between the Lambda functions and the Aurora PostgreSQL database.
Lambda functions scale rapidly and open many concurrent connections. RDS Proxy pools these connections, protecting the database from resource exhaustion.

Key Concept

Building secure, private, and highly scalable serverless architectures using API Gateway Private APIs, VPC-integrated Lambda functions, and RDS Proxy connection pooling.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic