Examkin

Question

Difficulty: Very hardModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A company is modernizing a legacy, highly transactional mainframe service by migrating it to a serverless architecture on AWS. The modernized application will receive public API calls via Amazon API Gateway and invoke backend logic on AWS Lambda. The Lambda functions must query and update an Amazon Aurora PostgreSQL database that is hosted in a private subnet within a VPC. The database contains highly sensitive data, and credentials must be rotated automatically without code modifications or environment variables. The API must only accept requests containing a valid custom cryptographic signature header, which must be verified against public verification keys stored in a centralized security account. During peak traffic bursts, the Lambda functions must not exhaust the regional concurrency limits of the AWS account or overwhelm the database with connections. Which combination of actions should a Solutions Architect take to design a secure, performant, and resilient architecture? (Select TWO.)

  1. Configure an Amazon API Gateway Lambda authorizer to verify the cryptographic signature. Configure the authorizer to retrieve the verification key from AWS Secrets Manager in the Security account using a Customer Managed Key (CMK) with cross-account IAM role permissions, caching the authorization result in API Gateway. Establish an Amazon RDS Proxy in the private subnets across multiple Availability Zones, and configure the backend Lambda function to connect to the database via the proxy using IAM database authentication.Answer
  2. Enable a Reserved Concurrency limit on the backend Lambda function that corresponds to the maximum database connections allowed by the RDS Proxy. Configure the Lambda function's VPC settings to deploy in multiple subnets across all available Availability Zones, ensuring the subnets are routed via multiple NAT Gateways in each Availability Zone for any external API outbound calls.Answer
  3. C
    To manage database connection limits, rely on the backend Lambda function's local initialization container memory to persist connections across invocations. Configure the database credentials to be retrieved directly from AWS Secrets Manager using the default AWS-managed KMS key (aws/secretsmanager) in the Security account to decrypt the credentials during each Lambda invocation.
  4. D
    Configure an API Gateway Lambda authorizer to verify the cryptographic signature. Deploy the backend Lambda function and RDS Proxy within a single private subnet in a single Availability Zone to ensure minimal network latency. Route all outbound internet traffic from this subnet through a single NAT Gateway located in the public subnet of the same Availability Zone.
  5. E
    To handle connection management during traffic bursts, configure API Gateway with a standard regional endpoint and route traffic to the backend Lambda function with unconstrained concurrency. Let the Lambda function scale dynamically to its maximum concurrency limits to maximize throughput, and enable Aurora Auto Scaling to dynamically add reader replicas to absorb the increased write and update queries on the database.

Answer

The correct actions are: 1) Configure an Amazon API Gateway Lambda authorizer that retrieves verification keys from AWS Secrets Manager in the Security account using a Customer Managed Key (CMK) and cross-account IAM permissions, and establish an Amazon RDS Proxy with IAM database authentication. 2) Enable a Reserved Concurrency limit on the backend Lambda function and deploy the function in multiple subnets across all Availability Zones routed through redundant NAT Gateways.
The correct architecture leverages an API Gateway Lambda authorizer that retrieves verification keys from a centralized Security account. This requires using a Customer Managed Key (CMK) because AWS-managed keys cannot have their key policies modified to allow cross-account decrypt operations. By caching the authorization result in API Gateway, cross-account calls are minimized. For database connectivity and security, using Amazon RDS Proxy with IAM database authentication ensures connection pooling and eliminates the need to manage database passwords or rotate credentials within the Lambda function. Additionally, setting a Reserved Concurrency limit on the Lambda function prevents it from overwhelming the RDS Proxy and database while protecting the regional unreserved concurrency pool from exhaustion. Deploying the Lambda function across multiple Availability Zones with redundant NAT Gateways ensures high availability and eliminates single points of failure for outbound traffic.

Step-by-Step Solution

1
Analyze the cross-account encryption and access control requirements for the cryptographic verification key store.
Determine that a Customer Managed Key (CMK) must be used in the Security account's key policy to allow cross-account decryption, as AWS-managed keys cannot be shared across accounts.
AWS-managed KMS keys do not support policy modifications to grant access to other accounts.
2
Analyze database connection management, credentials storage, and security.
Identify that Amazon RDS Proxy should be deployed in a multi-AZ private VPC configuration with IAM database authentication enabled for Lambda.
RDS Proxy manages connection pooling, and IAM auth removes the administrative overhead of password rotation and storage in Lambda code.
3
Evaluate the impact of high-volume burst traffic on Lambda concurrency and database capacity.
Define a Reserved Concurrency limit on the backend Lambda function to match database/proxy capacity limits.
Reserved Concurrency prevents the function from scaling past the database connection capacity and protects the regional account-wide concurrency pool from starvation.
4
Assess the high availability and resiliency design of the network and compute resources.
Configure the Lambda function to deploy in multiple subnets across different Availability Zones, and route internet-bound traffic through separate NAT Gateways in each Availability Zone.
Ensures no single point of failure exists in the outbound networking or compute path, matching AWS reliability best practices.

Key Concept

Modernizing transactional workloads with serverless architecture using API Gateway, Lambda, RDS Proxy, and cross-account KMS/Secrets Manager integrations.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic