A developer is troubleshooting a hotel reservation system. A backend microservice runs an … — AWS Certified Developer - Associate

A developer is troubleshooting a hotel reservation system. A backend microservice runs an AWS Lambda function that processes booking requests. The function is configured to connect to an Amazon Aurora PostgreSQL database deployed in private subnets within a custom VPC. After successfully updating the database, the function makes an HTTPS call to a third-party SMS gateway to send confirmation messages. During testing, database updates succeed, but the Lambda function execution fails. The Amazon CloudWatch logs show that the HTTPS request to the external SMS gateway times out, leading to a function-level timeout error: `Task timed out after $15.03$ seconds`. The VPC configurations are as follows: the Lambda function is associated with the same private subnets as the Aurora database; an Internet Gateway is attached to the VPC; the route tables for the private subnets have a default route ( $0.0.0.0/0$ ) pointing directly to the Internet Gateway; and the security group associated with the Lambda function allows all outbound traffic ( $0.0.0.0/0$ ). Which two actions should the developer take to resolve this network connectivity issue?

Deploy a NAT Gateway in a public subnet of the VPC.Cevap
Update the route table of the private subnets to direct traffic destined for $0.0.0.0/0$ to the NAT Gateway.Cevap
C
Move the Lambda function configuration to use the public subnets of the VPC that have a direct route to the Internet Gateway.
D
Enable the public IP mapping configuration on the Elastic Network Interfaces (ENIs) created by the Lambda function.
E
Increase the Lambda function timeout configuration to $15$ minutes to accommodate the connection attempts.

Cevap

To resolve the network connectivity issue, the developer must deploy a NAT Gateway in a public subnet and update the route tables of the private subnets containing the Lambda function to route outbound internet traffic through the NAT Gateway.

The correct response is to deploy a NAT Gateway in a public subnet and update the private subnet route tables to direct internet-bound traffic (

0.0.0.0/0

) to the NAT Gateway. Lambda functions deployed within a VPC must run in private subnets to access VPC resources like databases. Because Lambda ENIs lack public IP addresses, they cannot communicate with the internet directly via an Internet Gateway. A NAT Gateway situated in a public subnet acts as a bridge, translating the private IP traffic to a public IP and forwarding it to the Internet Gateway.

Adım Adım Çözüm

Analyze the network route requirements of the Lambda function.

The function requires private connectivity to the Aurora database and public connectivity to the third-party SMS gateway.

This determines that both internal VPC and external internet routing paths must be established.

Identify why the direct Internet Gateway route fails for the Lambda function.

Lambda functions in a VPC do not get assigned public IP addresses, meaning they cannot directly use an Internet Gateway even if associated with a public subnet or if a route exists.

This rule explains why the current configuration fails to connect to the external API.

Deploy a NAT Gateway to enable private-to-public network address translation.

A NAT Gateway is created in a public subnet, which has a route to the Internet Gateway.

The NAT Gateway acts as an intermediary that translates private traffic to a public IP.

Configure the private subnets to route outbound traffic through the NAT Gateway.

The route table for the private subnets where the Lambda function resides is updated to direct

0.0.0.0/0

traffic to the NAT Gateway.

This directs the Lambda function's external internet traffic correctly, resolving the timeouts.

Anahtar Kavram

Configuring VPC routing and NAT Gateways for AWS Lambda to access external internet endpoints

Tahmini Süre:2m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru