Examkin

Question

Difficulty: HardModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A pharmaceutical company is modernizing its clinical trial drug dispatch API on AWS. The system must process high-volume, bursty request patterns from external medical partners. The backend database is hosted on an Amazon Aurora PostgreSQL DB cluster inside a VPC. The API must be private, accessible only from the partners' on-premises networks via an existing AWS Direct Connect connection. To prevent database connection exhaustion during peak traffic, the architecture must incorporate an Amazon RDS Proxy. The security policy dictates that database credentials must be encrypted using a Customer Managed Key (CMK) in AWS KMS, and the Lambda functions must be restricted from accessing the public internet.

Which TWO actions should a solutions architect take to meet these requirements?

  1. Create an Amazon API Gateway private REST API and configure an interface VPC endpoint for API Gateway in the VPC. Attach an API Gateway resource policy to the private API that allows access only from the interface VPC endpoint ID, and route on-premises traffic through the Direct Connect connection to the private IP addresses of the VPC endpoint.Answer
  2. Create an Amazon Secrets Manager secret containing the database credentials, encrypted with a Customer Managed Key (CMK) in AWS KMS. Configure the RDS Proxy to use this secret, and grant the Lambda execution role and RDS Proxy role permissions to retrieve the secret and decrypt it using the CMK.Answer
  3. C
    Deploy the Lambda functions in private subnets with a route table directing outbound internet traffic to a single NAT Gateway to facilitate the database connection, while removing all concurrency limits on the Lambda functions to allow maximum scaling.
  4. D
    Store the database credentials in AWS Secrets Manager using the default AWS-managed KMS key (aws/secretsmanager), and configure the Secrets Manager resource policy to grant the cross-account Lambda execution role decryption permissions.
  5. E
    Configure the Lambda functions to connect directly to the database writer endpoint, and set the reserved concurrency of the Lambda functions to zero to protect other critical serverless workloads in the AWS account from resource exhaustion.

Answer

Create an Amazon API Gateway private REST API with an interface VPC endpoint and resource policy, and use AWS Secrets Manager with a Customer Managed Key to store credentials for the RDS Proxy.
Creating a private API Gateway REST API with an interface VPC endpoint and restricting access via resource policies ensures that all traffic remains private and travels over the Direct Connect connection. Using AWS Secrets Manager with a Customer Managed Key (CMK) satisfies the encryption requirements and allows appropriate IAM role access delegation for the RDS Proxy and Lambda functions.

Step-by-Step Solution

1
Configure the private API entry point
An API Gateway private REST API is created and associated with an interface VPC endpoint (execute-api) in the customer's VPC. A resource policy restricts access to this endpoint.
This ensures that API traffic remains private and is only accessible from the VPC and routed from on-premises over Direct Connect.
2
Configure database credential security and proxy access
An Amazon Secrets Manager secret is created and encrypted using a Customer Managed Key (CMK). The RDS Proxy is configured to retrieve these credentials using an IAM role.
This satisfies the requirement to use a CMK for encrypting credentials and allows the RDS Proxy to authenticate with the database.
3
Configure Lambda function network and IAM permissions
The Lambda functions are deployed within private subnets in the VPC with no route to a NAT Gateway, and are granted permissions to decrypt the database credentials via the KMS CMK policy.
This restricts the Lambda functions from accessing the public internet while allowing them to connect to the database via RDS Proxy and decrypt secrets.

Key Concept

Modernizing legacy workloads using a combination of API Gateway private endpoints, VPC-integrated Lambda functions, RDS Proxy for connection pooling, and Secrets Manager with KMS Customer Managed Keys.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic