Examkin

Question

Difficulty: HardModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A retail corporation is modernizing its on-premises inventory management backend by migrating to Amazon Aurora PostgreSQL. A serverless application using Amazon API Gateway and AWS Lambda will ingest high-frequency updates from partner supply-chain systems. The partner systems connect to the VPC using AWS Direct Connect.

The architecture must meet the following requirements:
- API traffic from partners must remain entirely private without traversing the public internet.
- Partner requests must be authenticated using OAuth2 tokens validated by a Lambda authorizer against an external Identity Provider (IdP) on the public internet.
- Database connection scaling must be managed efficiently.
- High-volume surges in inventory API traffic must not exhaust the regional account concurrency pool, which would throttle other critical applications.
- Credentials must be encrypted using AWS KMS, with the key policy configured to delegate management to a central security team.

Which architecture meets these requirements while aligning with AWS best practices?

  1. Deploy a Private API Gateway with an Interface VPC Endpoint. Configure the inventory Lambda function in the VPC to use Amazon RDS Proxy. Set Reserved Concurrency on the inventory Lambda function. Run the Lambda authorizer inside private subnets across multiple Availability Zones, routing outbound traffic through a NAT Gateway in each Availability Zone to validate tokens against the external Identity Provider. Encrypt database credentials using a Customer Managed Key (CMK) with a customized key policy.Answer
  2. B
    Deploy a Private API Gateway with an Interface VPC Endpoint. Configure the inventory Lambda function in the VPC to use Amazon RDS Proxy. Set Reserved Concurrency on the inventory Lambda function. Run the Lambda authorizer inside private subnets, routing all outbound traffic through a single NAT Gateway in a single Availability Zone to validate tokens against the external Identity Provider. Encrypt database credentials using a Customer Managed Key (CMK) with a customized key policy.
  3. C
    Deploy a Private API Gateway with an Interface VPC Endpoint. Configure the inventory Lambda function in the VPC to use Amazon RDS Proxy. Configure Provisioned Concurrency on the inventory Lambda function to handle initial traffic surges, without setting Reserved Concurrency limits. Run the Lambda authorizer inside private subnets across multiple Availability Zones, routing outbound traffic through a NAT Gateway in each Availability Zone. Encrypt database credentials using a Customer Managed Key (CMK) with a customized key policy.
  4. D
    Deploy a Private API Gateway with an Interface VPC Endpoint. Configure the inventory Lambda function in the VPC to use Amazon RDS Proxy. Set Reserved Concurrency on the inventory Lambda function. Run the Lambda authorizer inside private subnets across multiple Availability Zones, routing outbound traffic through a NAT Gateway in each Availability Zone. Encrypt database credentials using the default AWS-managed KMS key (aws/lambda) and modify its key policy to delegate administration to the central security team.

Answer

Deploy a Private API Gateway with an Interface VPC Endpoint, use Amazon RDS Proxy for connection pooling, set Reserved Concurrency on the inventory Lambda function, route the Lambda authorizer's outbound traffic through a NAT Gateway in each Availability Zone, and encrypt credentials using a Customer Managed Key (CMK) with a customized key policy.
The correct solution uses a Private API Gateway with a VPC endpoint for private access over Direct Connect. It deploys the inventory Lambda function inside the VPC using Amazon RDS Proxy to safely scale database connections. It establishes a Reserved Concurrency limit to prevent the function from exhausting the account-level concurrency pool, which safeguards other application functions. For authentication, the Lambda authorizer is deployed across multiple private subnets and accesses the public internet IdP via redundant NAT Gateways to avoid a single point of failure. Finally, it uses a Customer Managed Key (CMK) for credential encryption, allowing the customized key policy needed to delegate administrative control to the security team.

Step-by-Step Solution

1
Expose the API privately over Direct Connect.
A Private API Gateway is set up with an Interface VPC Endpoint in the VPC, allowing partner systems to reach it over Direct Connect without crossing the public internet.
Meets the requirement for private network transit.
2
Configure backend scaling and protection.
Amazon RDS Proxy is placed between the Lambda functions and the Aurora PostgreSQL database. Reserved Concurrency is configured on the inventory Lambda function.
RDS Proxy prevents database connection exhaustion. Reserved Concurrency limits and guarantees concurrency for the function, preventing it from consuming the entire regional account-level concurrency pool and throttling other workloads.
3
Set up outbound internet access for the Lambda authorizer.
The Lambda authorizer is deployed to private subnets across multiple Availability Zones. Outbound routes are configured through a NAT Gateway in each Availability Zone.
The authorizer must validate tokens against an external IdP on the public internet. Utilizing multiple NAT Gateways ensures high availability and resilience to AZ outages.
4
Configure secure credential encryption.
A Customer Managed Key (CMK) is created, and its key policy is configured to delegate management to the central security team.
AWS-managed keys (like aws/lambda) cannot have their key policies modified. A CMK is required to customize the policy for delegation.

Key Concept

Designing secure, highly available, and scalable serverless workloads with AWS Lambda and Amazon API Gateway integrated with VPC resources and external endpoints.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic