Examkin

Question

Difficulty: MediumSecrets and Parameters Management

An operations engineer is setting up scheduled credential updates for an Amazon RDS for MySQL database using AWS Secrets Manager. Both the database instance and the Lambda function performing the rotation are deployed inside private subnets of a VPC that lacks a NAT gateway and internet connectivity. The initial test of the rotation fails because the Lambda function cannot access either the database or the Secrets Manager API. Which of the following actions should the administrator take to resolve this issue? (Select TWO.)

  1. Configure an interface VPC endpoint (AWS PrivateLink) for Secrets Manager in the VPC, and ensure the Lambda function's security group allows outbound traffic to the endpoint's security group on port 443.Answer
  2. B
    Configure a gateway VPC endpoint for Secrets Manager in the VPC and associate it with the route tables of the private subnets.
  3. Configure the RDS for MySQL database security group to allow inbound traffic on port 3306 from the security group assigned to the Lambda rotation function.Answer
  4. D
    Modify the key policy of the default AWS managed key aws/secretsmanager to explicitly grant the Lambda execution role the kms:Decrypt and kms:DescribeKey permissions.
  5. E
    Attach an internet gateway to the VPC, and add a route in the private subnet route tables targeting the internet gateway to allow the Lambda function to reach the public Secrets Manager endpoint.

Answer

Configure an interface VPC endpoint for Secrets Manager and allow HTTPS traffic, and configure the RDS database security group to allow inbound port 3306 traffic from the Lambda security group.
To successfully rotate secrets for a database in a private subnet without internet access, two network communication paths must be established. First, the Lambda rotation function needs to communicate with AWS Secrets Manager. Since Secrets Manager is a public service and there is no NAT gateway, the administrator must create an interface VPC endpoint (AWS PrivateLink) for Secrets Manager in the VPC and ensure the Lambda's security group allows outbound HTTPS traffic to the endpoint. Second, the Lambda function must connect to the database to alter the user credentials. This requires configuring the RDS instance's security group to allow inbound database traffic on port 3306 from the Lambda function's security group.

Step-by-Step Solution

1
Analyze the VPC environment and the Lambda function's communication requirements.
The Lambda function is running in a private subnet with no outbound internet access. It must connect to the Secrets Manager service (HTTPS port 443) and the MySQL database (MySQL port 3306).
Determining where traffic is blocked is key to configuring the appropriate network pathways and security groups.
2
Select the correct VPC endpoint configuration for Secrets Manager.
Create an interface VPC endpoint for Secrets Manager in the private subnets and configure security groups to allow HTTPS traffic from the Lambda function.
Since the VPC lacks a NAT gateway, an interface endpoint (AWS PrivateLink) is required to establish private communication with the Secrets Manager service.
3
Establish the database network path.
Allow inbound traffic on port 3306 in the RDS database's security group from the Lambda function's security group.
The Lambda rotation function must establish a direct connection to the database instance to perform credential update operations.

Key Concept

AWS Secrets Manager automated rotation in a private VPC requires network paths to both the database and Secrets Manager. Private communication with Secrets Manager is achieved via an interface VPC endpoint, while security groups must be configured to permit traffic between the rotation Lambda function and the target database.
Estimated Time:2m 0s
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic