Examkin

Soru

Zorluk: OrtaServerless Development with AWS Lambda

A developer is configuring an AWS Lambda function to process customer registration events. The function must query an Amazon RDS MySQL database located in private VPC subnets. The database credentials are securely stored in AWS Secrets Manager. The developer wants to ensure the Lambda function can securely access the secret and connect to the database efficiently without causing database connection exhaustion or network timeouts. Which of the following configurations should the developer implement to meet these requirements? (Select TWO.)

  1. Initialize the database connection pool outside of the Lambda handler function to enable connection reuse across multiple invocations.Cevap
  2. Associate the Lambda function with the private subnets of the VPC, and configure an interface VPC endpoint (AWS PrivateLink) for Secrets Manager in the VPC.Cevap
  3. C
    Associate the Lambda function with a public subnet of the VPC and enable public IP assignment to allow direct communication with the Secrets Manager public endpoint.
  4. D
    Re-create and close the database connection inside the Lambda handler function on every invocation to prevent connection pool exhaustion.
  5. E
    Modify the trust policy of the Lambda function's execution role to grant permission for the secretsmanager:GetSecretValue action on the secret resource.

Cevap

To optimize database connection handling and ensure secure, private network access, the developer should initialize the database connection pool outside of the Lambda handler function, and associate the Lambda function with the private VPC subnets while configuring an interface VPC endpoint (AWS PrivateLink) for Secrets Manager.
Initializing the database connection pool outside the Lambda handler function leverages execution context reuse, enabling subsequent warm invocations to share the active connection pool. Additionally, associating the function with private subnets enables connectivity to the RDS instance, while configuring an interface VPC endpoint for Secrets Manager provides a secure, private route to fetch secrets without routing requests through the public internet.

Adım Adım Çözüm

1
Analyze the database connection lifecycle within serverless environments.
Initializing database connections inside the handler function executes the setup on every single invocation. Moving the connection logic outside the handler to the global scope preserves the connection object across warm starts, preventing database resource exhaustion.
Ensures Lambda execution context reuse is leveraged properly for database connection management.
2
Evaluate network connectivity requirements for VPC-bound resources and public endpoints.
The Lambda function needs to communicate with the RDS database in the private VPC subnet. However, a VPC-configured Lambda function cannot access external public endpoints (like Secrets Manager) without a NAT Gateway or an interface VPC endpoint. Deploying an interface VPC endpoint for Secrets Manager allows the function to access the service privately.
Establishes a secure and private network routing mechanism to retrieve database secrets.
3
Differentiate between IAM role policy types for execution privileges.
IAM trust policies define which entity can assume the role, whereas IAM permissions policies define the target actions allowed. The Lambda function requires a permissions policy allowing the secrets retrieval action.
Configures correct security authorization structure without misinterpreting the role trust policy.

Anahtar Kavram

AWS Lambda VPC networking, execution context reuse, and AWS Secrets Manager integration.
Bu soruyu puanla

Konular

Serverless Development with AWS Lambda

Bu konudan daha fazla soru