Examkin

Question

Difficulty: HardSecrets and Parameters Management

A company enforces a strict security policy that prohibits all internet egress from its production Amazon VPC. A SysOps administrator is configuring automatic credential rotation for an Amazon RDS for PostgreSQL DB instance. The database credentials are stored in AWS Secrets Manager, and the secret is encrypted using the default AWS managed key `aws/secretsmanager`.

The administrator deploys the rotation AWS Lambda function into the same private subnets as the RDS DB instance. However, during testing, the rotation fails. CloudWatch Logs for the rotation Lambda function show that the function times out while attempting to establish a connection to the Secrets Manager service endpoint to retrieve the current version of the secret.

Which action must the administrator take to resolve this network connectivity issue and allow the rotation to complete successfully?

  1. A
    Create a gateway VPC endpoint for AWS Secrets Manager within the VPC, and associate the gateway endpoint with the route tables of the private subnets.
  2. B
    Attach an IAM policy containing `iam:PassRole` permissions to the rotation Lambda function's execution role to authorize the Secrets Manager service to invoke the function.
  3. Create an interface VPC endpoint for AWS Secrets Manager within the VPC. Configure the security group of the interface VPC endpoint to allow inbound HTTPS traffic from the security group of the rotation Lambda function, and ensure that private DNS is enabled.Answer
  4. D
    Modify the key policy of the default AWS managed key `aws/secretsmanager` to explicitly grant the rotation Lambda execution role the `kms:Decrypt` and `kms:GenerateDataKey` permissions.

Answer

The correct action is to create an interface VPC endpoint for AWS Secrets Manager, configure its security group to accept HTTPS traffic from the Lambda function, and enable private DNS.
The correct action is to create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC. Because the VPC has no internet routing (NAT Gateway or Internet Gateway), the Lambda function running in the private subnet cannot reach public AWS endpoints. An interface VPC endpoint places an ENI in the private subnet, allowing the Lambda function to connect privately to Secrets Manager. Enabling private DNS ensures that the standard service hostname resolves to this private IP, and configuring the security group rules allows HTTPS communication between the Lambda function and the endpoint.

Step-by-Step Solution

1
Analyze the log error and network path.
Identify that the Lambda function is deployed in a private subnet with no internet route (no NAT Gateway or Internet Gateway) and times out when attempting to reach the Secrets Manager service endpoint.
Since the VPC lacks public internet access, private subnet resources cannot access public AWS service endpoints directly.
2
Select the correct VPC endpoint type.
Determine that AWS Secrets Manager supports interface VPC endpoints (PrivateLink) and does not support gateway VPC endpoints.
Interface endpoints use elastic network interfaces (ENIs) with private IP addresses to direct traffic to the service.
3
Configure the interface VPC endpoint and security groups.
Create the interface endpoint in the VPC, enable private DNS, and verify that its security group allows inbound HTTPS (port 443) traffic from the Lambda function's security group.
This establishes the local network route and access permissions, allowing the Lambda function to resolve and reach the endpoint securely.

Key Concept

Configuring VPC networking and endpoints for Secrets Manager rotation in isolated environments.
Estimated Time:2m 30s
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic