Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

An enterprise is modernizing a legacy internal reporting application by refactoring it into a serverless microservice. The microservice consists of an Amazon API Gateway API backed by an AWS Lambda function. The API Gateway and Lambda function are deployed in a producer AWS account. The API must only be accessible by client applications running within a VPC in a consumer AWS account. Both AWS accounts are members of the same AWS Organization. The solution must ensure that all API traffic remains private without traversing the public internet, and administrative overhead must be minimized. Which architecture should a solutions architect recommend to meet these requirements?

  1. A
    Deploy a regional API Gateway in the producer account. Use AWS Resource Access Manager (RAM) to share the API Gateway resource with the consumer AWS account. In the consumer VPC, configure a Route 53 Resolver rule to route API traffic directly to the shared API Gateway over an active VPC peering connection established between the consumer and producer VPCs.
  2. B
    Deploy a private API Gateway in the producer account. In the consumer VPC, configure an AWS Transit Gateway that routes all API traffic to a transit VPC in the producer account. Configure the transit VPC to route requests to the private API Gateway through a public NAT Gateway, and apply IP-based restrictions on the API Gateway resource policy.
  3. Deploy a private API Gateway in the producer account, and attach an API Gateway resource policy that allows access from the consumer VPC endpoint. In the consumer account, create an interface VPC endpoint for API Gateway in the consumer VPC. In the producer account, authorize the association of the API's private hosted zone with the consumer VPC, and complete the association in the consumer account.Answer
  4. D
    Deploy a private API Gateway in the producer account. In the consumer VPC, create an interface VPC endpoint for API Gateway. Configure the API Gateway resource policy to allow the consumer account ID as the principal. Create a Route 53 Private Hosted Zone in the producer account for the API domain, and assume that DNS resolution will automatically propagate to all VPCs within the AWS Organization.

Answer

Deploy a private API Gateway in the producer account, and attach an API Gateway resource policy that allows access from the consumer VPC endpoint. In the consumer account, create an interface VPC endpoint for API Gateway in the consumer VPC. In the producer account, authorize the association of the API's private hosted zone with the consumer VPC, and complete the association in the consumer account.
The architecture using a private API Gateway in the producer account, an interface VPC endpoint in the consumer account, and a cross-account Route 53 Private Hosted Zone association is the correct solution because it keeps all traffic private, resolves DNS natively, and minimizes administrative overhead.

Step-by-Step Solution

1
Deploy a private API Gateway in the producer account and associate it with the backend Lambda function.
The API is created but is not yet accessible from the consumer VPC.
Establishing a private endpoint requires a private API Gateway configuration.
2
In the consumer VPC, create an interface VPC endpoint (execute-api) for API Gateway.
An elastic network interface is created in the consumer VPC to route traffic privately to API Gateway.
This allows client applications in the consumer VPC to reach API Gateway without traversing the public internet.
3
Attach a resource policy to the private API Gateway in the producer account to allow access from the interface VPC endpoint ID in the consumer VPC.
API Gateway permissions are configured to authorize requests originating from the consumer's VPC endpoint.
Private API Gateways require a resource policy that explicitly allows access from the specific VPC endpoint.
4
Authorize the association of the private hosted zone of the API with the consumer VPC from the producer account, and then associate the consumer VPC with the private hosted zone in the consumer account.
The consumer VPC can now resolve the private API Gateway's DNS name locally.
Cross-account Private Hosted Zone association is required for native DNS resolution across different AWS accounts.

Key Concept

Cross-account private API Gateway access and Private Hosted Zone association
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic