Examkin

Soru

Zorluk: OrtaServerless Development with AWS Lambda

A developer is building a serverless application. An AWS Lambda function is configured to run in the private subnets of a VPC to retrieve data from a private Amazon Aurora PostgreSQL DB cluster. The Lambda function also needs to call a public web service to retrieve reference data. Currently, the Lambda function can connect to the database but cannot connect to the public web service. Which two actions must the developer take to allow the function to connect to the public web service while maintaining access to the private database? (Select two.)

  1. Configure a NAT Gateway in a public subnet of the VPC and update the route tables of the private subnets to route traffic destined for 0.0.0.0/0 through the NAT Gateway.Cevap
  2. Ensure the Lambda function's IAM execution role has the permissions defined in the AWSLambdaVPCAccessExecutionRole managed policy.Cevap
  3. C
    Associate the Lambda function with the public subnets of the VPC to allow the function to automatically receive a public IP address.
  4. D
    Create a Gateway VPC Endpoint for the public web service and associate it with the route tables of the subnets.
  5. E
    Configure the Lambda function to use a customer-managed IAM role without VPC-related permissions to bypass security group rules.

Cevap

To allow the Lambda function to access the public web service while keeping database access, configure a NAT Gateway in a public subnet of the VPC, update the private subnets' route tables to route outbound traffic through it, and ensure the Lambda function's execution role has the permissions defined in the AWSLambdaVPCAccessExecutionRole policy.
To route outbound internet traffic from a VPC-enabled Lambda function, the function must be deployed in private subnets, and the subnet route tables must route 0.0.0.0/0 through a NAT Gateway. In addition, the Lambda function requires the AWSLambdaVPCAccessExecutionRole managed policy to allow it to provision the necessary network interfaces (ENIs) inside the customer VPC.

Adım Adım Çözüm

1
Add a NAT Gateway to a public subnet in the VPC.
The NAT Gateway is provisioned with a public IP address and has an outbound path to the Internet Gateway.
This establishes a bridge between the private subnet and the public internet.
2
Update the route table of the private subnets where the Lambda function resides to route 0.0.0.0/0 to the NAT Gateway.
Internet-bound traffic from the private subnets is successfully forwarded to the NAT Gateway.
This enables resources within the private subnets, including the Lambda function, to route requests to the public API.
3
Attach the AWSLambdaVPCAccessExecutionRole managed policy to the Lambda execution role.
The role obtains the necessary ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, and ec2:DeleteNetworkInterface permissions.
This allows the Lambda service to create Elastic Network Interfaces (ENIs) inside the customer VPC for database access.

Anahtar Kavram

AWS Lambda VPC networking, ENI provisioning, and NAT Gateway routing for internet access from private subnets.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Serverless Development with AWS Lambda

Bu konudan daha fazla soru