Examkin

Question

Difficulty: Very hardModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A retail enterprise is modernizing its legacy on-premises inventory replenishment system by moving to a serverless architecture on AWS. The system must expose a private REST API via Amazon API Gateway to multiple partner AWS accounts over an AWS Transit Gateway. The API invokes AWS Lambda functions deployed inside private subnets of a shared services VPC. These Lambda functions must perform high-frequency read and write operations against a centralized Amazon Aurora PostgreSQL database situated in a dedicated database VPC. The database credentials are stored in AWS Secrets Manager within the database VPC account. The Lambda functions in the shared services account must retrieve and decrypt these credentials. The design must prevent database connection exhaustion, support cross-account access to the credentials, and ensure that bursts in replenishment traffic do not exhaust the regional concurrency limits, which would throttle other critical customer-facing Lambda functions in the shared services account. Which TWO options should a solutions architect implement to meet these requirements? (Select TWO.)

  1. Provision an Amazon RDS Proxy endpoint in the shared services VPC to pool database connections to the Aurora PostgreSQL database, and configure reserved concurrency on the inventory replenishment Lambda function.Answer
  2. Create a Customer Managed Key (CMK) in AWS KMS within the database account, configure its key policy to grant the Lambda execution role in the shared services account permission to decrypt, and use this key to encrypt the secret in AWS Secrets Manager.Answer
  3. C
    Create the database credentials secret in AWS Secrets Manager using the default AWS-managed KMS key in the database account, and attach an IAM policy to the Lambda execution role in the shared services account that allows cross-account decryption of that key.
  4. D
    Deploy a single NAT Gateway in one Availability Zone of the shared services VPC to route outgoing traffic from the private subnets to the Aurora PostgreSQL database and the Secrets Manager endpoints.
  5. E
    Configure provisioned concurrency on the inventory replenishment Lambda function to pre-warm execution environments, and rely on the default regional unreserved concurrency pool to automatically scale the replenishment workload during traffic spikes.

Answer

The solutions architect should provision an Amazon RDS Proxy endpoint in the shared services VPC to pool database connections to the Aurora PostgreSQL database, configure reserved concurrency on the inventory replenishment Lambda function, and create a Customer Managed Key (CMK) in AWS KMS within the database account with a key policy configured to grant the Lambda execution role in the shared services account permission to decrypt, using this key to encrypt the secret in AWS Secrets Manager.
The correct solution involves provisioning an Amazon RDS Proxy endpoint to pool database connections to the Aurora PostgreSQL database, limiting the concurrency impact using Lambda reserved concurrency, and utilizing a Customer Managed Key (CMK) in AWS KMS to allow cross-account credential decryption. RDS Proxy manages database connection pooling efficiently. Reserved concurrency guarantees that the high-volume function does not exhaust the regional concurrency limits. A CMK allows modifying the key policy to delegate cross-account access to the shared services account's Lambda execution role.

Step-by-Step Solution

1
Analyze database connection limits and scaling characteristics of Lambda.
Identify that scaling Lambda functions create a 1:11:1 relationship with database connections, which can exhaust Aurora PostgreSQL connection limits.
To determine the need for a database connection pooler.
2
Evaluate options for database connection pooling.
Select Amazon RDS Proxy to pool and share connections, buffering traffic spikes.
To safeguard database availability and resource consumption.
3
Analyze account-level concurrency settings for Lambda.
Determine that using Reserved Concurrency on the replenishment Lambda function limits its maximum concurrent executions, preventing it from consuming the entire regional pool.
To protect other critical customer-facing functions from concurrency starvation.
4
Evaluate cross-account KMS key access requirements for Secrets Manager.
Identify that AWS-managed KMS keys do not support policy modifications for cross-account access, necessitating the creation of a Customer Managed Key (CMK) with a cross-account key policy.
To allow the shared services Lambda execution role to decrypt the database credentials.

Key Concept

Designing secure, resilient, and performant serverless architectures using Amazon RDS Proxy for connection pooling, Lambda Reserved Concurrency for blast radius limitation, and Customer Managed Keys for cross-account KMS decryption.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic