Examkin

Soru

Zorluk: ZorServerless Development with AWS Lambda

A developer has configured an AWS Lambda function to run inside a private subnet of a custom VPC to query an Amazon RDS PostgreSQL database. The function must also retrieve API keys from AWS Secrets Manager and call an external third-party payment gateway over the internet. During testing, the function consistently times out when attempting to call the Secrets Manager service and the payment gateway. Which combination of network and code configurations will resolve these timeouts while maintaining access to the RDS database?

  1. Configure a NAT Gateway in a public subnet of the VPC, update the private subnet's route table to route non-VPC traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway, and retrieve the API keys dynamically in the function handler using the AWS SDK.Cevap
  2. B
    Associate the Lambda function with a public subnet of the VPC, enable the auto-assign public IP setting on that subnet, and retrieve the API keys dynamically in the function handler using the AWS SDK.
  3. C
    Move the Lambda function out of the custom VPC to restore default internet access, hardcode the RDS database credentials and the third-party API keys as plaintext variables in the SDK client initialization, and execute the queries directly.
  4. D
    Increase the Lambda function's timeout configuration to 15 minutes to allow for transient network delays, and use the global execution context to cache the database connection and the API keys across invocations.

Cevap

Configure a NAT Gateway in a public subnet of the VPC, update the private subnet's route table to route non-VPC traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway, and retrieve the API keys dynamically in the function handler using the AWS SDK.
To allow a Lambda function inside a private subnet of a VPC to access both internet-facing resources (the external payment gateway) and public AWS service endpoints (like AWS Secrets Manager), you must route outbound internet traffic through a NAT Gateway. The NAT Gateway must be placed in a public subnet that has a route to an Internet Gateway. The private subnet's route table is then updated to forward all outbound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway. This configuration preserves the function's ability to communicate with the RDS database in the private subnet while resolving the connectivity timeouts to external services.

Adım Adım Çözüm

1
Identify the cause of the connection timeout.
The Lambda function inside the private subnet cannot reach public endpoints because it lacks a route to the internet.
By default, a private VPC subnet does not have access to public AWS services or external endpoints unless routed through a NAT Gateway or VPC Endpoint.
2
Configure outbound internet access for the private subnet.
A NAT Gateway is deployed in a public subnet, and the private subnet's route table is updated to forward 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway.
This establishes a route for the Lambda function to communicate with both the public AWS Secrets Manager service and the external third-party gateway.
3
Ensure secure credentials management and local access.
The Lambda function remains in the private VPC subnet to access the RDS database securely, and API keys are retrieved dynamically at runtime.
This conforms to the AWS Shared Responsibility Model and security best practices by avoiding hardcoded credentials and keeping the database isolated.

Anahtar Kavram

VPC Networking and Outbound Routing for AWS Lambda Functions
Bu soruyu puanla

Konular

Serverless Development with AWS Lambda

Bu konudan daha fazla soru