A company is modernizing a legacy laboratory data integration system by migrating it to a … — AWS Certified Solutions Architect - Professional

A company is modernizing a legacy laboratory data integration system by migrating it to a serverless architecture on AWS. The system must ingest high-volume, bursty clinical test reports at a peak rate of $3,500\text{ requests per second}$ from partner clinics located in external AWS accounts. The API must validate custom JWT tokens against an identity database before forwarding payloads. The payloads must then be written to an Amazon Aurora PostgreSQL database in the company's private VPC. The database cluster has a maximum capacity of $150$ concurrent connections. The company's AWS account has a default regional Lambda concurrency limit of $1,000$ executions. The solutions architect must design a highly available, secure, and reliable architecture that prevents database connection exhaustion and avoids exhausting the regional Lambda concurrency pool. Which combination of steps should the solutions architect take to meet these requirements?

A
Create a Regional Amazon API Gateway with a custom Lambda authorizer. Deploy the ingestion Lambda function in a single private subnet, routing all outbound internet and database traffic through a single NAT Gateway in a single public subnet. Set a reserved concurrency limit of $120$ on the ingestion Lambda function, and configure it to connect to the database through an Amazon RDS Proxy endpoint.
Create a Regional Amazon API Gateway with an API Gateway resource policy restricting access to the partner accounts' source VPC endpoints. Configure a Lambda authorizer with caching enabled to validate JWT tokens. Deploy the ingestion Lambda function in private VPC subnets across three Availability Zones. Set a reserved concurrency limit of $120$ on the ingestion Lambda function, and configure it to connect to the database through an Amazon RDS Proxy endpoint.Answer
C
Create a Regional Amazon API Gateway with a custom Lambda authorizer. Deploy the ingestion Lambda function in private VPC subnets across three Availability Zones. Configure provisioned concurrency on the ingestion Lambda function to pre-warm $500$ instances to handle the traffic spikes. Point the Lambda function to an Amazon RDS Proxy endpoint, and rely on the RDS Proxy to queue connection requests during peak bursts.
D
Create a Regional Amazon API Gateway with a custom Lambda authorizer. Deploy the ingestion Lambda function in private VPC subnets across three Availability Zones with a reserved concurrency limit of $120$ . Configure the Lambda authorizer to decrypt credentials passed by the partner accounts using the default AWS-managed KMS key for API Gateway (`aws/apigateway`) shared with the partner accounts. Configure the Lambda function to connect to the database through an Amazon RDS Proxy endpoint.

Answer

Create a Regional Amazon API Gateway with a resource policy restricting access to partner accounts, configure a cached Lambda authorizer, deploy the ingestion Lambda function across three Availability Zones with a reserved concurrency limit of

120

, and route database connections through an Amazon RDS Proxy endpoint.

The correct solution addresses all requirements: it uses a Regional API Gateway with a resource policy to restrict access to external partner accounts, validates custom tokens via a cached Lambda authorizer, ensures high availability by deploying across three Availability Zones, limits the database connection footprint using Amazon RDS Proxy, and sets a reserved concurrency limit of

120

to protect the company's regional concurrency limit from depletion during bursts.

Step-by-Step Solution

Evaluate access control and authorization requirements.

Using an API Gateway resource policy secures the endpoint against unauthorized cross-account access, while caching authorization decisions in the Lambda authorizer reduces latency and lookup overhead.

Ensures that external clinics are securely authenticated without putting unnecessary load on the identity reference database.

Design the network and compute layout for the ingestion Lambda function.

Deploy the Lambda function in private subnets across three Availability Zones to ensure high availability and eliminate single points of failure.

Aligns with the reliability pillar of the AWS Well-Architected Framework by avoiding non-redundant NAT Gateway topologies.

Address database connection limits and Lambda concurrency protection.

Deploy Amazon RDS Proxy to manage connection pooling to the Aurora PostgreSQL database, and set a reserved concurrency limit of

120

on the Lambda function.

Setting reserved concurrency protects the AWS account's regional concurrency pool (

1,000

executions) from exhaustion during traffic bursts. In combination with RDS Proxy, it ensures database connections do not exceed the

150

limit.

Key Concept

To safely modernize legacy databases using serverless components, you must control concurrency scaling at the Lambda level to protect downstream database resources and protect the regional concurrency pool, while ensuring high-availability networking and proper cross-account security controls.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic