Examkin

Question

Difficulty: HardModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A maritime shipping enterprise is modernizing its legacy vessel telemetry tracking system to a serverless architecture. The legacy system currently processes bursty ingestion traffic from global cargo ships and writes updates to an Amazon Aurora PostgreSQL DB cluster hosted in a private subnet of a central Virtual Private Cloud (VPC). The new architecture must ingest telemetry data via Amazon API Gateway and process it using AWS Lambda before writing to the database.

The solution must meet the following requirements:
- Protect the Aurora PostgreSQL database from connection exhaustion during sudden traffic spikes of up to 1500015{}000 concurrent writes.
- Ensure the Lambda functions can access the database securely and privately within the VPC without traversing the public internet.
- Allow only specific client VPCs within the company's AWS Organization to call the API Gateway privately.
- Implement a deployment strategy that gradually routes traffic to new Lambda function versions with automated rollbacks upon error detection.

Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Deploy an Amazon RDS Proxy for the Aurora PostgreSQL DB cluster, configure the Lambda functions to connect to the database via the proxy, and set a reserved concurrency limit on the Lambda functions to align with the database connection pool.Answer
  2. Deploy an Amazon API Gateway private API associated with interface VPC endpoints in the central VPC, apply an API Gateway resource policy that grants access only to the interface VPC endpoint IDs of the client VPCs, and use AWS CodeDeploy with AWS CloudFormation to perform a canary deployment of the Lambda functions.Answer
  3. C
    Configure provisioned concurrency on the Lambda functions to scale up to 1500015{}000 concurrent executions during spikes, and establish direct connections from the Lambda functions to the Aurora DB cluster to minimize latency.
  4. D
    Configure the Lambda functions with a rolling update deployment strategy in AWS CloudFormation, and deploy a single NAT Gateway in one Availability Zone to route outbound Lambda traffic to a regional public API Gateway endpoint.
  5. E
    Deploy a regional public API Gateway endpoint, configure cross-account IAM roles to allow the client VPCs to invoke the API, and encrypt the telemetry payload using the AWS-managed KMS key `aws/lambda` in the central account.

Answer

Deploy an Amazon RDS Proxy for the Aurora DB cluster combined with Lambda reserved concurrency to protect the database from connection exhaustion, and implement an API Gateway private API with interface VPC endpoints and resource policies to secure access, while using AWS CodeDeploy for canary deployments.
The correct solution involves deploying Amazon RDS Proxy to pool database connections, preventing exhaustion during traffic spikes, and setting a reserved concurrency limit on the Lambda functions to protect the database cluster. Private API Gateway access is achieved using interface VPC endpoints combined with an API Gateway resource policy that filters by VPC endpoint ID, ensuring only the specified client VPCs have access. AWS CodeDeploy provides the canary deployment configuration necessary to route traffic gradually with automatic rollback capabilities.

Step-by-Step Solution

1
Address database connection exhaustion and scaling constraints.
Amazon RDS Proxy is positioned between Lambda and the Aurora DB cluster to reuse and pool connections, while Reserved Concurrency is configured on the Lambda functions to limit maximum concurrent executions and avoid overwhelming the database.
Lambda functions scale rapidly and can exhaust database connections; RDS Proxy mitigates this by pooling connections, and reserved concurrency provides a hard limit to protect database performance.
2
Configure private API Gateway access from client VPCs.
A private API Gateway endpoint is deployed. Interface VPC endpoints (PrivateLink) are configured, and a resource policy is attached to the API Gateway to restrict traffic only to requests originating from the specific client VPC endpoint IDs.
This keeps traffic completely off the public internet and isolates the endpoint to authorized VPCs within the organization.
3
Implement safe deployment and rollback mechanisms.
AWS CodeDeploy is integrated with the CloudFormation deployment of Lambda to execute a Canary or Linear deployment, dynamically routing a fraction of traffic to the new version and automatically rolling back if CloudWatch Alarms trigger.
This guarantees zero-downtime updates and maintains application availability in case of deployment errors.

Key Concept

Modernizing legacy workloads using serverless architectures with strict security, scaling, and deployment controls.
Estimated Time:2m 30s
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic