Examkin

Question

Difficulty: Very hardModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A financial services organization is modernizing its payment processing pipeline. The pipeline receives high-volume transaction notifications from an external payment gateway through Amazon API Gateway and routes them to AWS Lambda functions. The Lambda functions process the transactions and update a highly utilized Amazon RDS PostgreSQL database located in a private subnet. The processed transactions must also be archived to an Amazon S3 bucket in a separate, central security audit AWS account for long-term retention.

The architecture must satisfy the following constraints:
1. Prevent sudden transaction bursts from exhausting the concurrency limits of other critical workloads in the AWS account.
2. Avoid overwhelming the RDS PostgreSQL database connection pool.
3. Ensure high availability for the egress network path from the Lambda functions to external verification endpoints.
4. Encrypt the archived S3 objects and allow the central security audit account to decrypt them.
5. Provide a safe deployment mechanism for new Lambda function versions with automated rollback capabilities.

Which TWO strategies should the Solutions Architect implement to meet these requirements? (Select TWO.)

  1. Provision an Amazon RDS Proxy between the Lambda functions and the database, and configure a reserved concurrency limit on the transaction-processing Lambda function.Answer
  2. Deploy the Lambda functions in private subnets across multiple Availability Zones with a NAT Gateway in each Availability Zone, use AWS CodeDeploy with a canary deployment configuration for Lambda function updates, and encrypt S3 archives using a Customer Managed KMS Key with a policy that allows the security audit account to decrypt the data.Answer
  3. C
    Deploy the Lambda functions in private subnets across multiple Availability Zones pointing to a single NAT Gateway in a single Availability Zone, and encrypt the archived objects using the default AWS-managed S3 KMS key (aws/s3).
  4. D
    Deploy the Lambda functions without reserved concurrency to allow maximum scalability during peak transaction bursts, and use a rolling deployment configuration (AllAtOnce) to update the Lambda functions as quickly as possible.
  5. E
    Provision an Amazon RDS Proxy between the Lambda functions and the database, and encrypt the archived objects using an AWS-managed KMS key while configuring a Service Control Policy (SCP) to grant cross-account access to the security audit account.

Answer

Implementing RDS Proxy and reserved concurrency, along with deploying redundant NAT Gateways, canary deployments via CodeDeploy, and a Customer Managed KMS Key for S3 encryption.
Implementing Amazon RDS Proxy manages database connections efficiently and prevents overloading the RDS instance. Configuring a reserved concurrency limit on the transaction-processing Lambda function protects other critical applications in the account from throttling during high-volume bursts. Redundant NAT Gateways across Availability Zones eliminate a single point of failure for outbound traffic. AWS CodeDeploy allows for safe, automated canary deployments with rollback mechanisms. Finally, encrypting S3 objects with a Customer Managed KMS Key enables cross-account decrypt permissions via key policies, which is not supported by AWS-managed KMS keys.

Step-by-Step Solution

1
Address connection pooling and concurrency scaling safety.
Amazon RDS Proxy is added to pool database connections, and a reserved concurrency limit is configured on the transaction-processing Lambda function.
RDS Proxy prevents database crash from exhaustion of connections under peak loads. Reserved concurrency protects the wider account from API bursts that would exhaust the regional pool.
2
Ensure egress network redundancy.
Deploy the Lambda functions in private subnets pointing to separate NAT Gateways in each Availability Zone.
A single NAT Gateway creates a single point of failure; multi-AZ NAT Gateways ensure high availability during AZ outages.
3
Configure cross-account S3 encryption keys.
Use a Customer Managed Key in AWS KMS, updating its key policy to grant decrypt permission to the central security audit account's role.
AWS-managed KMS keys (like aws/s3) cannot be shared with external AWS accounts.
4
Establish a safe release mechanism.
Utilize AWS CodeDeploy with a canary deployment configuration (e.g., Canary10Percent5Minutes) linked to CloudWatch Alarms.
This allows progressive traffic shifting and automated rollback if errors occur during updates, achieving zero downtime.

Key Concept

Modernizing legacy workloads using serverless architectures (Lambda and API Gateway) requires a multi-layered design integrating secure cross-account KMS access, highly available network topology, database connection pooling, account-level concurrency protections, and automated deployment strategies.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic