Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

An enterprise is modernizing a legacy scheduling system by refactoring its API backend to a serverless architecture on AWS. The modernized solution uses Amazon API Gateway and AWS Lambda. The API must securely query a PostgreSQL database hosted on Amazon RDS in a private subnet. The Lambda function must also make HTTP requests to a third-party webhook validation API over the public internet. The system must support high-volume transaction spikes without exhausting database connections, and the database credentials must be securely stored and accessible by a compliance auditing service hosted in a separate AWS account. Which TWO actions should the Solutions Architect take to design a secure, reliable, and performant solution?

  1. Deploy an Amazon RDS Proxy in the private subnets of the VPC, and configure the Lambda function to connect to the database via the RDS Proxy endpoint.Answer
  2. Store the database credentials in AWS Secrets Manager, encrypt the secret using a Customer Managed Key (CMK), and configure a resource policy on the secret to grant read access to the auditing account.Answer
  3. C
    Configure the Lambda function with a high reserved concurrency limit to handle peak traffic spikes, and connect the Lambda function directly to the RDS PostgreSQL instance.
  4. D
    Deploy the Lambda function in private subnets across multiple Availability Zones, and configure route tables to direct outbound internet traffic to a single NAT Gateway deployed in a public subnet of one Availability Zone.
  5. E
    Store the database credentials in AWS Secrets Manager, encrypt the secret using the default AWS-managed KMS key, and authorize the cross-account role in the auditing account to decrypt the secret.

Answer

Deploy an Amazon RDS Proxy in the private subnets of the VPC, and configure the Lambda function to connect via the RDS Proxy endpoint; and store the database credentials in AWS Secrets Manager, encrypt the secret using a Customer Managed Key (CMK), and configure a resource policy to grant cross-account read access.
Deploying Amazon RDS Proxy handles connection management dynamically, protecting the database from scaling spikes. Using Secrets Manager with a Customer Managed Key allows the custom policy modification necessary to delegate access to a separate auditing account.

Step-by-Step Solution

1
Implement connection pooling.
Amazon RDS Proxy is deployed inside the VPC.
Since serverless Lambda functions can scale rapidly and open many concurrent connections, RDS Proxy pools these connections to prevent database exhaustion.
2
Ensure secure cross-account credential sharing.
Secrets Manager stores the credentials with a Customer Managed Key.
AWS-managed keys cannot be shared cross-account because their policies cannot be edited. A Customer Managed Key allows the necessary key policy changes to grant access to the auditing account.
3
Establish high-availability outbound networking.
Multiple NAT Gateways are deployed across Availability Zones.
To maintain reliability when calling external APIs, outbound traffic must not depend on a single NAT Gateway.

Key Concept

Serverless VPC integration, connection pooling with RDS Proxy, and secure cross-account KMS key access.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic