Examkin

Question

Difficulty: HardModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A logistics company is modernizing a legacy package tracking and address validation service. The service is being rebuilt on AWS using Amazon API Gateway and AWS Lambda functions deployed within a private VPC subnet. The Lambda functions must retrieve database credentials from AWS Secrets Manager in a different shared services account, write tracking details to an Amazon Aurora PostgreSQL database, and make HTTP requests to an external transit carrier's address validation endpoint. During a peak traffic test, the database rejected new connections, and the burst of tracking requests exhausted the AWS account's execution concurrency, causing latency and failures in other critical, unrelated serverless workloads in the same region. Which combination of actions will resolve these issues while ensuring high availability and adhering to security best practices?

  1. Configure Amazon RDS Proxy to manage database connection pooling. Configure a reserved concurrency limit on the Lambda function. Set up a Customer Managed Key (CMK) in AWS KMS in the shared services account to encrypt the Secrets Manager secret, and configure the key policy to allow the Lambda execution role to decrypt. Deploy a NAT Gateway in each Availability Zone where the Lambda functions are deployed.Answer
  2. B
    Configure Amazon RDS Proxy to manage database connection pooling. Configure provisioned concurrency on the Lambda function to handle the bursty traffic without configuring a reserved concurrency limit. Set up a Customer Managed Key (CMK) in AWS KMS in the shared services account to encrypt the Secrets Manager secret, and configure the key policy to allow the Lambda execution role to decrypt. Deploy a NAT Gateway in each Availability Zone where the Lambda functions are deployed.
  3. C
    Configure Amazon RDS Proxy to manage database connection pooling. Configure a reserved concurrency limit on the Lambda function. Use the default AWS-managed key `aws/secretsmanager` to encrypt the Secrets Manager secret in the shared services account, and update the default key policy to allow the cross-account Lambda execution role to decrypt. Deploy a NAT Gateway in each Availability Zone where the Lambda functions are deployed.
  4. D
    Configure Amazon RDS Proxy to manage database connection pooling. Configure a reserved concurrency limit on the Lambda function. Set up a Customer Managed Key (CMK) in AWS KMS in the shared services account to encrypt the Secrets Manager secret, and configure the key policy to allow the Lambda execution role to decrypt. Deploy a single NAT Gateway in one Availability Zone, and update the route tables of all private subnets to route external carrier validation traffic through it.

Answer

Configure Amazon RDS Proxy, set a reserved concurrency limit on the Lambda function, use a Customer Managed Key (CMK) in KMS with a customized key policy for Secrets Manager decryption, and deploy NAT Gateways in multiple Availability Zones.
The correct option addresses all requirement vectors. First, it uses Amazon RDS Proxy to manage database connection pooling, preventing Aurora from rejecting connections due to scaling spikes. Second, it configures a reserved concurrency limit on the Lambda function, which protects the account's regional pool from exhaustion while guaranteeing execution slots for this workload. Third, it encrypts the database credentials secret with a Customer Managed Key (CMK) in KMS, permitting key policy edits for cross-account access (which default AWS-managed keys do not support). Finally, it deploys NAT Gateways in multiple Availability Zones to ensure high availability for outbound external validation requests.

Step-by-Step Solution

1
Implement Amazon RDS Proxy between the Lambda functions and the Aurora PostgreSQL database.
Database connections are pooled and reused, protecting the database from reaching its maximum connection limit during traffic spikes.
Lambda functions scale rapidly and can launch thousands of concurrent executions, quickly exhausting the database's available connection slots if not managed.
2
Configure a reserved concurrency limit on the high-volume package tracking Lambda function.
The Lambda function's maximum scale-out is capped, protecting the regional pool from exhaustion while reserving a baseline capacity for this function.
Without a reserved concurrency limit, a massive spike in requests can consume the account's entire regional concurrency pool, causing throttling for all other serverless workloads.
3
Create a Customer Managed Key (CMK) in AWS KMS within the shared services account, encrypt the secret, and modify the key policy.
The Lambda execution role in the consumer VPC account is granted decryption rights for the database credentials.
Default AWS-managed keys do not permit policy customization, preventing cross-account access delegation.
4
Deploy redundant NAT Gateways across multiple Availability Zones in the VPC.
The Lambda functions maintain highly available outbound connectivity for address validation API calls.
Deploying a single NAT Gateway creates a single point of failure that would disrupt all outbound connectivity if the hosting Availability Zone fails.

Key Concept

Modernizing legacy workloads using Amazon API Gateway and AWS Lambda, managing database connection limits with RDS Proxy, securing regional concurrency, enforcing cross-account KMS delegation using CMKs, and configuring redundant NAT Gateways.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic