Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A municipal transit authority is modernizing its on-premises ticketing system by migrating to a serverless architecture on AWS. The application will expose a public API for third-party transit applications to query real-time schedule updates and purchase tickets, which is expected to experience sudden, massive spikes in traffic during rush hours. The backend database is an Amazon RDS PostgreSQL DB instance situated in private subnets within a VPC. The new design must scale dynamically to handle rush-hour spikes, protect the database from connection exhaustion, ensure that traffic bursts do not throttle other critical serverless workloads in the AWS account, and encrypt all data at rest using customer-managed keys (CMKs). Which architectural design meets these requirements?

  1. Deploy an Amazon API Gateway REST API. Configure an AWS Lambda function integrated with the API Gateway, deploying it inside the VPC private subnets. Create an Amazon RDS Proxy in the private subnets to manage connections to the RDS PostgreSQL database. Configure reserved concurrency on the Lambda function, and encrypt the RDS database and Lambda environment variables using a KMS customer managed key.Answer
  2. B
    Deploy an Amazon API Gateway REST API. Configure an AWS Lambda function integrated with the API Gateway, deploying it inside the VPC private subnets. Configure the Lambda function to connect directly to the RDS PostgreSQL database. Do not configure any concurrency limits on the Lambda function to allow it to scale dynamically to maximum regional limits, and encrypt the database using the default AWS-managed KMS key 'aws/rds'.
  3. C
    Deploy an Amazon API Gateway REST API. Configure an AWS Lambda function integrated with the API Gateway, deploying it inside the VPC private subnets. Create an Amazon RDS Proxy in the private subnets to manage database connections. Route all outbound Lambda traffic to the internet through a single NAT Gateway located in one public subnet, and encrypt the RDS database using the default AWS-managed KMS key 'aws/rds'.
  4. D
    Deploy an Amazon API Gateway REST API. Configure an AWS Lambda function integrated with the API Gateway, deploying it inside the VPC private subnets. Create an Amazon RDS Proxy in the private subnets. Configure provisioned concurrency on the Lambda function to handle the traffic spikes. Use AWS CodeDeploy with a linear deployment strategy to update the Lambda function without configuring CloudWatch rollback alarms, and encrypt the database using a KMS customer managed key.

Answer

Deploy an Amazon API Gateway REST API with an AWS Lambda function in the VPC private subnets, an Amazon RDS Proxy to manage database connections, reserved concurrency configured on the Lambda function, and a KMS customer managed key for encryption.
The correct architecture integrates Amazon API Gateway with an AWS Lambda function in the VPC private subnets, utilizing Amazon RDS Proxy to manage connection pooling and prevent database resource exhaustion. Configuring reserved concurrency on the Lambda function sets a maximum scaling limit, which prevents rush-hour spikes from consuming the regional account's entire concurrency pool and throttling other workloads. Using a KMS customer managed key (CMK) satisfies the security policy for custom encryption management.

Step-by-Step Solution

1
Evaluate backend database connectivity and scaling.
Amazon RDS Proxy must be used between the Lambda function and the RDS PostgreSQL instance to pool database connections, ensuring the database does not exhaust its connection limit during rush-hour traffic spikes.
Serverless architectures using AWS Lambda spin up rapid concurrent instances, which can quickly exceed the connection limits of a relational database.
2
Ensure regional Lambda concurrency protection.
Configure reserved concurrency on the ticketing Lambda function.
Reserved concurrency limits the maximum number of concurrent executions for a specific function, preserving the remaining concurrency pool for other critical workloads in the AWS account.
3
Implement security and encryption policies.
Use a Customer Managed Key (CMK) in AWS KMS to encrypt database storage and Lambda environment variables.
AWS-managed keys (such as aws/rds) do not allow policy customization and fail to meet the customer-managed requirement.

Key Concept

To modernize database-backed applications with serverless compute, utilize Amazon RDS Proxy to manage connection pooling, configure Lambda reserved concurrency to protect regional concurrency pools from exhaustion, and use AWS KMS Customer Managed Keys for custom security policies.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic