Examkin

Soru

Zorluk: ZorVPC Security for Developers

An organization is deploying a secure microservice where an AWS Lambda function is configured to run inside a private subnet of a custom VPC. The function must retrieve database credentials from AWS Secrets Manager and query an Amazon DynamoDB table. To meet strict security standards, no traffic is allowed to traverse the public internet. The developer has created a gateway VPC endpoint for DynamoDB and an interface VPC endpoint for Secrets Manager in the same private subnet. While DynamoDB queries succeed, the Lambda function times out when attempting to retrieve credentials from Secrets Manager. Which action must the developer take to allow the Lambda function to successfully retrieve the secrets?

  1. A
    Move the Lambda function to a public subnet within the VPC and assign a public IP address to its execution configuration to allow direct routing to the public Secrets Manager endpoint.
  2. B
    Update the trust policy of the Lambda execution role to trust the interface VPC endpoint service principal, allowing the network interface to assume the role's permissions.
  3. Configure the security group attached to the Secrets Manager interface VPC endpoint to allow inbound TCP port 443 traffic from the security group attached to the Lambda function.Cevap
  4. D
    Migrate the database credentials from AWS Secrets Manager to Systems Manager Parameter Store and provision a gateway VPC endpoint for Parameter Store.

Cevap

Configure the security group attached to the Secrets Manager interface VPC endpoint to allow inbound TCP port 443 traffic from the security group attached to the Lambda function.
The correct option correctly configures the security group associated with the Secrets Manager interface VPC endpoint. Interface endpoints (PrivateLink) create network interfaces inside the VPC with private IP addresses. For the Lambda function to reach these network interfaces over HTTPS, the security group of the interface endpoint must allow inbound traffic on TCP port 443 from the security group of the Lambda function.

Adım Adım Çözüm

1
Analyze the network path and failure point.
The Lambda function times out when attempting to connect to Secrets Manager. Because there is no NAT Gateway or internet path, traffic must route through the interface VPC endpoint.
Since the DynamoDB query succeeds via the gateway endpoint, the Lambda function's internal VPC subnet configuration and basic execution routing are functional, indicating a specific block on the Secrets Manager interface endpoint path.
2
Identify the network requirements for interface VPC endpoints.
Interface endpoints (AWS PrivateLink) deploy ENIs inside the VPC. Clients connect to these ENIs using HTTPS on TCP port 443.
Unlike gateway endpoints, interface endpoints act as local network interfaces in the subnet and are subject to security group evaluation.
3
Configure the endpoint security group rules.
Add an inbound rule to the security group associated with the Secrets Manager interface VPC endpoint allowing TCP port 443 traffic from the Lambda function's security group.
This permits the Lambda function's network interface to successfully initiate and complete the TLS handshake with the Secrets Manager endpoint ENIs.

Anahtar Kavram

Security group configuration for interface VPC endpoints
Bu soruyu puanla

Konular

VPC Security for Developers

Bu konudan daha fazla soru