Examkin

Soru

Zorluk: OrtaDebugging Lambda Execution and Configuration Issues

A serverless microservice uses an AWS Lambda function to retrieve user configuration profiles from an Amazon ElastiCache cluster located in a private VPC subnet, and then sends SMS notifications by calling a third-party gateway's HTTP API over the internet. The Lambda function is configured to run in the same VPC and private subnets as the ElastiCache cluster. During execution, the Lambda function successfully connects to ElastiCache, but the HTTP requests to the third-party gateway consistently fail with connection timeout errors. Which two configuration actions should the developer take to resolve this network connectivity issue? (Select TWO.)

  1. A
    Move the Lambda function to a public subnet of the VPC to grant it direct internet access through the VPC's Internet Gateway.
  2. Deploy a NAT Gateway in a public subnet of the VPC, and configure the route table of the Lambda function's private subnets to route traffic destined for 0.0.0.0/00.0.0.0/0 through the NAT Gateway.Cevap
  3. C
    Enable the public IP assignment configuration option on the Lambda function to allow direct routing through the Internet Gateway.
  4. Verify that the security group associated with the Lambda function has outbound rules allowing egress HTTP/HTTPS traffic to the internet.Cevap
  5. E
    Attach the AWS-managed policy AWSLambdaVPCAccessExecutionRole to the Lambda function's execution role to grant it internet routing permissions.

Cevap

Deploy a NAT Gateway in a public subnet of the VPC, route traffic destined for the internet through it, and ensure the Lambda function's security group allows outbound HTTP/HTTPS traffic.
The correct options involve deploying a NAT Gateway in a public subnet and configuring the private subnet's route table to direct internet-bound traffic (0.0.0.0/00.0.0.0/0) to it, while also verifying that the Lambda function's security group allows outbound egress traffic on web ports. This ensures both routing and firewall policies allow the Lambda function to reach the external HTTP API.

Adım Adım Çözüm

1
Analyze the network paths and resources.
The database connection to ElastiCache works because both resources are inside the private subnets of the VPC. The outbound internet calls fail because there is no route to the internet from the private subnets.
Identifying that the failure is related to outbound internet access helps narrow down the solution to VPC egress configurations.
2
Configure the routing tables for internet access.
Deploy a NAT Gateway in a public subnet, and add a route to 0.0.0.0/00.0.0.0/0 in the private subnet's route table pointing to the NAT Gateway.
This establishes a valid network path for resources in the private subnets to communicate with public internet services.
3
Verify security group rules.
Ensure the security group attached to the Lambda function permits outbound traffic to the internet on ports 80 and 443.
Even with correct route tables, restrictive outbound security group rules can block connection attempts.

Anahtar Kavram

Lambda VPC networking requires a NAT Gateway for outbound internet access from private subnets.
Bu soruyu puanla

Konular

Debugging Lambda Execution and Configuration Issues

Bu konudan daha fazla soru