Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A digital healthcare provider is modernizing its medical document processing application by refactoring a legacy webhook receiver into a serverless architecture on AWS. The webhook receiver accepts completed document upload notifications from external partner AWS accounts, decrypts the payloads using an AWS KMS key shared with the partners, and processes the payload metadata before writing it to an Amazon Aurora PostgreSQL database.

The solution must meet the following architectural requirements:
- Provide a highly available, public HTTPS endpoint to receive webhook notifications.
- Prevent large spikes in partner webhook volume from consuming all execution concurrency in the AWS account, which would throttle other critical synchronous API functions.
- Support key sharing and decryption of the payloads sent by external partner AWS accounts.
- Prevent connection exhaustion on the Aurora database during traffic bursts.
- Maintain high availability across multiple Availability Zones for all compute and network egress components.

Which of the following architectures meets these requirements with the least operational risk?

  1. Configure an Amazon API Gateway REST API as the public endpoint. Integrate the API Gateway with a Lambda function that uses an AWS KMS Customer Managed Key (CMK) with a key policy allowing cross-account access for the partner accounts. Deploy the Lambda function across multiple private subnets in different Availability Zones using redundant NAT Gateways, configure an Amazon RDS Proxy, and apply Reserved Concurrency to the Lambda function.Answer
  2. B
    Configure an Amazon API Gateway REST API as the public endpoint. Integrate the API Gateway with a Lambda function that uses an AWS KMS Customer Managed Key (CMK) with a key policy allowing cross-account access for the partner accounts. Deploy the Lambda function across multiple private subnets in different Availability Zones using redundant NAT Gateways and configure an Amazon RDS Proxy, but do not set any concurrency limit on the Lambda function to allow it to auto-scale freely during sudden payload surges.
  3. C
    Configure an Amazon API Gateway REST API as the public endpoint. Integrate the API Gateway with a Lambda function that decrypts payloads using the default AWS-managed KMS key for Lambda (aws/lambda) with cross-account access enabled. Deploy the Lambda function across multiple private subnets in different Availability Zones using redundant NAT Gateways, configure an Amazon RDS Proxy, and apply Reserved Concurrency to the Lambda function.
  4. D
    Configure an Amazon API Gateway REST API as the public endpoint. Integrate the API Gateway with a Lambda function that uses an AWS KMS Customer Managed Key (CMK) with a key policy allowing cross-account access for the partner accounts. Deploy the Lambda function inside a single private subnet in one Availability Zone with a single NAT Gateway to reduce egress costs, configure an Amazon RDS Proxy, and apply Reserved Concurrency to the Lambda function.

Answer

Configure an Amazon API Gateway REST API as the public endpoint. Integrate the API Gateway with a Lambda function that uses an AWS KMS Customer Managed Key (CMK) with a key policy allowing cross-account access for the partner accounts. Deploy the Lambda function across multiple private subnets in different Availability Zones using redundant NAT Gateways, configure an Amazon RDS Proxy, and apply Reserved Concurrency to the Lambda function.
The correct architecture uses Amazon API Gateway to provide the public HTTPS endpoint and a Lambda function configured with a Customer Managed Key (CMK) to allow the necessary cross-account decryption permissions. By setting Reserved Concurrency on the Lambda function, the workload is prevented from exhausting the regional execution pool and throttling other synchronous services. Deploying the function across multiple subnets with redundant NAT Gateways ensures high availability for network egress, and RDS Proxy prevents database connection pool exhaustion during traffic surges.

Step-by-Step Solution

1
Expose the API public endpoint and handle scaling.
Use API Gateway REST API to receive partner webhooks and trigger the Lambda function.
API Gateway automatically handles HTTPS endpoints and scales transparently with incoming webhook traffic.
2
Configure secure decryption of payloads from external accounts.
Create a KMS Customer Managed Key and configure the key policy to permit cross-account kms:Decrypt actions for partner IAM identities.
AWS-managed keys (like aws/lambda) cannot have their policies altered to allow cross-account access, so a Customer Managed Key is required.
3
Apply concurrency control to protect the AWS account.
Configure Reserved Concurrency on the Lambda function.
Setting Reserved Concurrency restricts the maximum concurrent executions of this specific function, preventing it from consuming the entire regional pool and starving other business-critical synchronous functions.
4
Ensure secure, scalable database connectivity and network egress high availability.
Deploy the Lambda function in private subnets across multiple Availability Zones with redundant NAT Gateways and route DB queries through an Amazon RDS Proxy.
Using RDS Proxy protects Aurora from connection exhaustion during Lambda scaling, and redundant NAT Gateways prevent a single Availability Zone outage from disrupting outbound traffic.

Key Concept

Applying Reserved Concurrency on Lambda prevents unconstrained scaling from exhausting the regional concurrency pool, while Customer Managed Keys enable secure cross-account key sharing and RDS Proxy protects databases from connection spikes.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic