Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A hotel reservation platform is modernizing its booking confirmation service by migrating to a serverless architecture on AWS. The system must process booking events sent via an Amazon API Gateway HTTP API, parse the JSON payload using an AWS Lambda function, call an external payment processor API on the public internet, and write reservation details to an Amazon Aurora PostgreSQL database in a private subnet. The database credentials must be retrieved from AWS Secrets Manager, which is managed in a separate centralized security AWS account. During peak promotional periods, the platform experiences sudden traffic spikes of up to 10,000 requests per second. The database has a limited connection pool. The solutions architect needs to design a highly available, scalable, and secure architecture that protects the database from connection exhaustion, provides outbound internet access for the Lambda function, prevents the Lambda function from exhausting the regional account-level concurrency pool, and allows cross-account retrieval of the database credentials. Which architecture should the solutions architect implement to meet these requirements?

  1. A
    Configure the Lambda function to run in private subnets across multiple Availability Zones, routing outbound internet traffic through a single NAT Gateway in one Availability Zone to optimize network costs. Deploy Amazon RDS Proxy to manage database connections. Configure reserved concurrency on the Lambda function. Use a Customer Managed Key in AWS Key Management Service (AWS KMS) with a cross-account key policy to encrypt the credentials secret.
  2. B
    Configure the Lambda function to run in private subnets across multiple Availability Zones, routing outbound internet traffic through NAT Gateways deployed in each Availability Zone. Deploy Amazon RDS Proxy to manage database connections. Configure reserved concurrency on the Lambda function. Use the default AWS-managed KMS key (aws/secretsmanager) in the security account to encrypt the credentials secret, and grant the Lambda execution role cross-account decrypt permissions.
  3. Configure the Lambda function to run in private subnets across multiple Availability Zones, routing outbound internet traffic through NAT Gateways deployed in each Availability Zone. Deploy Amazon RDS Proxy to manage database connections. Configure reserved concurrency on the Lambda function. Use a Customer Managed Key in AWS Key Management Service (AWS KMS) with a cross-account key policy to encrypt the credentials secret in the central security account.Answer
  4. D
    Configure the Lambda function to run in private subnets across multiple Availability Zones, routing outbound internet traffic through NAT Gateways deployed in each Availability Zone. Deploy Amazon RDS Proxy to manage database connections. Use a Customer Managed Key in AWS KMS with a cross-account key policy to encrypt the credentials secret. Leave the Lambda function's concurrency unconfigured to allow the function to scale freely during peaks.

Answer

Configure the Lambda function to run in private subnets across multiple Availability Zones, routing outbound internet traffic through NAT Gateways deployed in each Availability Zone. Deploy Amazon RDS Proxy to manage database connections. Configure reserved concurrency on the Lambda function. Use a Customer Managed Key in AWS Key Management Service (AWS KMS) with a cross-account key policy to encrypt the credentials secret in the central security account.
The correct architecture uses Amazon RDS Proxy to manage and pool connections to the PostgreSQL database, protecting it from exhaustion. Placing the Lambda function in private subnets spanning multiple Availability Zones with dedicated NAT Gateways ensures highly available outbound routing to external payment APIs. Configuring reserved concurrency prevents the function from scaling out of control and throttling other critical workloads in the account. Finally, using a Customer Managed Key in AWS KMS with a cross-account key policy allows the primary account's Lambda function to securely decrypt the database credentials stored in Secrets Manager in the centralized security account.

Step-by-Step Solution

1
Address database connection limits under scaling pressure
Amazon RDS Proxy is introduced between AWS Lambda and the Aurora PostgreSQL database.
RDS Proxy pools database connections, preventing connection exhaustion during spikes of 10,000 requests per second.
2
Ensure secure and highly available outbound connectivity for the Lambda function
The Lambda function is configured to run inside private subnets across multiple Availability Zones, with routing tables directing outbound traffic to NAT Gateways in each Availability Zone.
This setup allows the Lambda function to access the external payment API on the public internet while maintaining Multi-AZ high availability.
3
Protect the AWS account from regional Lambda throttling
Reserved concurrency is configured specifically for the booking confirmation Lambda function.
This places a hard ceiling on the number of concurrent executions for this specific function, preventing it from consuming the entire regional limit and starving other applications.
4
Configure secure cross-account decryption of database credentials
The credentials secret in AWS Secrets Manager is encrypted using a Customer Managed KMS key with a policy allowing cross-account decryption by the Lambda execution role.
AWS-managed KMS keys (like aws/secretsmanager) cannot have their policies modified, which prevents them from being shared across accounts.

Key Concept

Modernizing legacy workloads to serverless architectures on AWS requires a comprehensive design that manages compute scaling (concurrency), database resource limits (RDS Proxy), high availability networking (multi-AZ NAT Gateways), and cross-account security controls (KMS Customer Managed Keys).
Estimated Time:2m 0s
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic