Examkin

Soru

Zorluk: ZorVPC Security for Developers

A software developer is writing a data reconciliation script that runs on AWS Lambda. The script must retrieve credentials from AWS Secrets Manager and query a PostgreSQL database hosted on an Amazon RDS instance that resides in the private subnets of a custom VPC. The Lambda function must run inside the custom VPC to connect to the database. Security policies require that all network traffic between the Lambda function, the database, and AWS Secrets Manager remains entirely within the VPC.

Which of the following actions should the developer take to establish secure and functional network connectivity for the Lambda function? (Select TWO.)

  1. Configure the Lambda function to connect to the private subnets of the VPC, and create an Interface VPC Endpoint for AWS Secrets Manager with Private DNS enabled.Cevap
  2. Configure the security group of the Amazon RDS instance to allow inbound database traffic from the security group assigned to the Lambda function.Cevap
  3. C
    Configure the Lambda function to connect directly to the public subnets of the VPC to enable direct access to both the RDS database and the public Secrets Manager endpoint.
  4. D
    Modify the IAM trust relationship of the Lambda execution role to trust the Amazon RDS service principal (rds.amazonaws.com).
  5. E
    Store the database credentials in Systems Manager Parameter Store, and enable native automatic rotation using the Parameter Store console.

Cevap

The correct actions are: configuring the Lambda function to connect to the private subnets of the VPC while creating an Interface VPC Endpoint for AWS Secrets Manager, and configuring the security group of the Amazon RDS instance to allow inbound traffic from the Lambda function's security group.
To connect the Lambda function to the database securely, the function must reside in the same VPC private subnets. An Interface VPC Endpoint (PrivateLink) for AWS Secrets Manager is required to allow the function to call Secrets Manager APIs over private IP addresses. Additionally, the RDS security group must explicitly allow inbound traffic from the security group associated with the Lambda function.

Adım Adım Çözüm

1
Determine the network placement for the Lambda function.
The Lambda function must be associated with the private subnets of the VPC to route traffic to the RDS instance in the same private subnets.
VPC-connected Lambda functions need to be in subnets that have a network path to the resources they need to access.
2
Set up secure connection to AWS Secrets Manager.
Create an Interface VPC Endpoint (AWS PrivateLink) for Secrets Manager in the VPC subnets with Private DNS enabled.
This allows the Lambda function to resolve the Secrets Manager DNS name to a private IP within the VPC, ensuring traffic does not traverse the public internet.
3
Configure Security Group rules for RDS.
Add an inbound rule to the RDS security group that permits traffic on the database port (e.g., port 5432 for PostgreSQL) from the security group attached to the Lambda function.
Security groups act as a firewall at the resource level, and this rule is required to permit the inbound connection from the Lambda function.

Anahtar Kavram

VPC Security for Developers
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

VPC Security for Developers

Bu konudan daha fazla soru