Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A travel booking aggregator is migrating its legacy flight search API to a serverless architecture on AWS. The new application will use Amazon API Gateway to expose REST endpoints and AWS Lambda to process user requests. The Lambda functions must read and write reservation details to an Amazon RDS PostgreSQL database located in a private VPC subnet. During high-traffic marketing events, the volume of concurrent Lambda executions is expected to spike drastically, which could exceed the maximum database connection limits. Additionally, the Lambda functions must securely connect to external airline partner APIs over the public internet. Which TWO of the following configurations should the solutions architect implement to meet these requirements? (Select TWO.)

  1. Configure the Lambda functions within the private VPC subnets and route outbound internet traffic through redundant NAT Gateways deployed across multiple Availability Zones.Answer
  2. Deploy an Amazon RDS Proxy in the private VPC subnets associated with the database, and configure the Lambda functions to connect to the RDS Proxy endpoint instead of the database endpoint.Answer
  3. C
    Configure the Lambda functions within the private VPC subnets and route all outbound internet traffic through a single NAT Gateway deployed in one Availability Zone to minimize operational costs.
  4. D
    Configure a strict Reserved Concurrency limit on the Lambda functions to act as the primary connection pooler and restrict the total connections to the RDS database.
  5. E
    Enable credential storage in AWS Secrets Manager using the default AWS-managed KMS key (aws/secretsmanager) and configure cross-account Lambda functions in partner accounts to decrypt the database credentials using this key.

Answer

To modernize the workload with serverless Lambda and API Gateway securely and reliably, the solutions architect should configure the Lambda functions inside private VPC subnets with outbound routing through redundant NAT Gateways across multiple Availability Zones, and deploy Amazon RDS Proxy in the private VPC subnets to manage and pool connections to the RDS PostgreSQL database.
The correct solution involves two main aspects: scalability/database protection and high-availability network egress. To handle concurrent execution spikes without overloading the PostgreSQL database, Amazon RDS Proxy must be used because it pools and multiplexes connections. To enable secure outbound internet connectivity for VPC-bound Lambda functions while avoiding a single point of failure, the architect must place the Lambda functions in private subnets and route their traffic through redundant NAT Gateways deployed across multiple Availability Zones.

Step-by-Step Solution

1
Analyze database connection scaling issues.
Identified that Lambda's rapid scaling will exceed the RDS PostgreSQL connection limit.
Unlike traditional servers, serverless functions scale horizontally by launching individual instances, each creating its own database connection. A pooling mechanism is required to prevent database exhaustion.
2
Evaluate Amazon RDS Proxy.
Recognized that RDS Proxy pools and shares database connections, reducing CPU and memory overhead on the database.
RDS Proxy handles the connection spikes gracefully, queuing requests if the database is under heavy load rather than failing them.
3
Analyze network access requirements for external partner APIs.
Identified that Lambda functions inside the VPC need secure egress to the public internet.
Since the functions are in a private VPC subnet to access the RDS database and RDS Proxy, they cannot have public IP addresses directly. They must route their internet-bound traffic through NAT Gateways.
4
Ensure high availability for outbound traffic.
Selected redundant NAT Gateways across multiple Availability Zones.
Standard multi-AZ architectures require a NAT Gateway in each AZ to avoid a single point of failure and to satisfy AWS Well-Architected reliability guidelines.

Key Concept

Modernizing legacy workloads using serverless compute (Lambda) with private database resources requires robust connection pooling (RDS Proxy) and highly available outbound VPC egress (multi-AZ NAT Gateways) to handle massive spikes in transaction volume while securing internal connections.
Estimated Time:2m 30s
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic