Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

An insurance provider is modernizing its claims intake system by refactoring a legacy API to a serverless architecture on AWS. The new API is deployed using Amazon API Gateway and routes requests to an AWS Lambda function. This function processes the claims, invokes an external third-party API over the internet to validate claim details, and stores the results in an Amazon Aurora PostgreSQL database. During peak periods, the system experiences sudden, massive spikes in traffic. A secondary auditing application in a separate AWS account also needs to retrieve database credentials from AWS Secrets Manager to verify claims data. Which architecture should a solutions architect design to meet these requirements securely and reliably?

  1. Deploy the Lambda function in private subnets across multiple Availability Zones, and route outbound internet traffic through redundant NAT Gateways. Configure Amazon RDS Proxy to manage connection pooling to the Aurora database. Store the database credentials in AWS Secrets Manager, encrypting them with a Customer Managed Key in AWS KMS to allow cross-account access, and configure a reserved concurrency limit on the Lambda function.Answer
  2. B
    Deploy the Lambda function in private subnets across multiple Availability Zones, and route outbound internet traffic through redundant NAT Gateways. Configure Amazon RDS Proxy to manage connection pooling to the Aurora database. Store the database credentials in AWS Secrets Manager, encrypting them with a Customer Managed Key in AWS KMS. Leave the Lambda function's concurrency limits unconfigured to allow the function to automatically scale to the maximum regional limit during traffic spikes.
  3. C
    Deploy the Lambda function in private subnets across multiple Availability Zones, and route all outbound internet traffic through a single NAT Gateway in one Availability Zone to minimize cost. Configure Amazon RDS Proxy to manage connection pooling to the Aurora database. Store the database credentials in AWS Secrets Manager, encrypting them with a Customer Managed Key in AWS KMS, and configure a reserved concurrency limit on the Lambda function.
  4. D
    Deploy the Lambda function in private subnets across multiple Availability Zones, and route outbound internet traffic through redundant NAT Gateways. Configure Amazon RDS Proxy to manage connection pooling to the Aurora database. Store the database credentials in AWS Secrets Manager, encrypting them with the AWS-managed KMS key aws/secretsmanager to simplify key rotation, and configure a reserved concurrency limit on the Lambda function.

Answer

Deploying the Lambda function in multi-AZ private subnets with redundant NAT Gateways, using RDS Proxy for connection pooling, encrypting Secrets Manager secrets using a Customer Managed KMS key, and configuring reserved concurrency on the Lambda function.
The correct architecture configures RDS Proxy to prevent database connection exhaustion, places the Lambda function in a multi-AZ private subnet with redundant NAT Gateways to ensure highly available outbound connectivity for third-party API validation, uses a Customer Managed Key in KMS to allow cross-account key delegation to the auditing application, and configures a reserved concurrency limit on the Lambda function to protect the rest of the account's regional concurrency capacity from being exhausted by unexpected claims ingestion spikes.

Step-by-Step Solution

1
Evaluate the database connection handling under bursty traffic conditions.
Amazon RDS Proxy should be selected to pool database connections and avoid overloading Aurora PostgreSQL with rapid connection cycles.
Serverless Lambda scale-out can exhaust database connection limits without connection management.
2
Determine the requirements for internet access and high availability.
The Lambda function needs redundant NAT Gateways across multiple AZs to ensure outbound internet connectivity is not vulnerable to a single AZ failure.
The function must access a third-party API over the internet reliably.
3
Address the cross-account access requirement for the database credentials.
Use AWS Secrets Manager encrypted with a Customer Managed KMS Key rather than an AWS-managed key.
AWS-managed KMS keys do not allow policy edits required for cross-account delegation.
4
Protect the account's regional concurrency pool against starvation.
Configure a reserved concurrency limit on the claims processing Lambda function.
Reserved concurrency bounds the burst scaling to prevent exhausting the account's overall regional execution capacity.

Key Concept

Designing secure, highly-available serverless architectures integrated with VPCs, relational databases, and cross-account access controls.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic