Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A media company is migrating its legacy content metadata ingestion system to a serverless architecture on AWS. The system must process high-volume, bursty traffic from external publishing partners, decrypt incoming metadata payloads that are encrypted in an Amazon S3 bucket, and write updates to an Amazon Aurora PostgreSQL database. The design must be highly available, run within a private subnet, connect to the database securely without exhausting connections, and prevent traffic surges from throttling other critical Lambda functions in the AWS account. The external partners run their applications in a separate AWS account and need permission to access the encrypted S3 bucket. Which architecture meets these requirements?

  1. Configure Amazon API Gateway with a regional endpoint that triggers an AWS Lambda function. Configure the Lambda function in the VPC across multiple Availability Zones with an Amazon RDS Proxy to handle database connections. Set reserved concurrency on the Lambda function. Encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK) and grant cross-account access in the key policy. Configure NAT Gateways in multiple Availability Zones for outbound connectivity.Answer
  2. B
    Configure Amazon API Gateway with a regional endpoint that triggers an AWS Lambda function. Configure the Lambda function in the VPC across multiple Availability Zones with an Amazon RDS Proxy. Leave the Lambda concurrency unconfigured to allow the function to scale automatically to its maximum limits. Encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK) and grant cross-account access in the key policy. Configure NAT Gateways in multiple Availability Zones.
  3. C
    Configure Amazon API Gateway with a regional endpoint that triggers an AWS Lambda function. Configure the Lambda function in the VPC across multiple Availability Zones with an Amazon RDS Proxy. Set reserved concurrency on the Lambda function. Encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK) and grant cross-account access in the key policy. Configure a single NAT Gateway in a single Availability Zone to route all outbound VPC traffic to save costs.
  4. D
    Configure Amazon API Gateway with a regional endpoint that triggers an AWS Lambda function. Configure the Lambda function in the VPC across multiple Availability Zones with an Amazon RDS Proxy. Set reserved concurrency on the Lambda function. Encrypt the S3 bucket using the default AWS-managed KMS key (aws/s3) and update its key policy to grant cross-account access. Configure NAT Gateways in multiple Availability Zones.

Answer

Configure Amazon API Gateway with a regional endpoint, run the AWS Lambda function in the VPC across multiple Availability Zones using Amazon RDS Proxy, set a reserved concurrency limit on the Lambda function, encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK) with cross-account access granted, and deploy NAT Gateways in multiple Availability Zones.
The correct answer provides a highly available, secure, and isolated solution. Running AWS Lambda within a multi-AZ VPC subnet and utilizing Amazon RDS Proxy ensures secure database communication while preventing connection limits from being exceeded during traffic bursts. Configuring reserved concurrency isolates the ingestion workload's concurrency usage, protecting other applications in the region from being throttled. A Customer Managed Key (CMK) is required because AWS-managed keys (such as aws/s3) cannot be shared across accounts. Lastly, deploying NAT Gateways in multiple Availability Zones eliminates single points of failure for outbound routing.

Step-by-Step Solution

1
Select the appropriate compute, database connection, and endpoint configurations.
Amazon API Gateway routes requests to Lambda, which uses RDS Proxy to queue and manage connection pooling to the Aurora PostgreSQL database, preventing connection exhaustion.
This guarantees that bursty traffic does not overwhelm the database with excessive concurrent connections.
2
Isolate compute resources from other applications in the account.
Configure reserved concurrency on the ingestion Lambda function.
Reserved concurrency limits the maximum number of concurrent executions for this specific function, protecting the account's regional concurrency pool from depletion and saving capacity for other critical applications.
3
Address the cross-account encryption requirements.
Encrypt the S3 bucket with a Customer Managed Key (CMK) in AWS KMS and add cross-account permissions in the key policy.
AWS-managed KMS keys (like aws/s3) cannot have their policies modified, so a Customer Managed Key is required to allow external AWS accounts to decrypt files.
4
Design the network architecture for high availability.
Deploy the Lambda function in private subnets across multiple Availability Zones and deploy multiple NAT Gateways.
A single NAT Gateway creates a single point of failure, violating high availability principles.

Key Concept

Serverless application architecture requiring connection pooling (RDS Proxy), resource isolation (Reserved Concurrency), cross-account encryption access (KMS CMK), and network fault tolerance (multi-AZ NAT Gateways).
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic