A developer is configuring an AWS Lambda function that runs inside a private subnet of a VPC. The Lambda function needs to connect to an Amazon RDS database in another private subnet and call an external third-party API over the public internet.
Which two network and security configurations are required to establish these connections?
- Configure the RDS security group to allow inbound traffic on the database port from the security group assigned to the Lambda function.Cevap
- Route traffic destined for the internet () from the Lambda function's private subnet through a NAT Gateway located in a public subnet.Cevap
- CAdd a route pointing to an Internet Gateway () directly in the route table of the Lambda function's private subnet.
- DModify the Lambda execution role's IAM trust policy to grant the database connection permission.
- EStore the database credentials in AWS Systems Manager Parameter Store and enable automatic rotation of the parameter to secure the connection.
Cevap
To establish the required connections, the RDS security group must be configured to allow inbound traffic on the database port from the Lambda function's security group, and a route to a NAT Gateway in a public subnet must be added to the private subnet's route table to allow outbound internet access for external API calls.
The correct configurations involve setting up an inbound security group rule on the RDS database that allows traffic from the Lambda function's security group, and routing internet-bound traffic from the private subnet to a NAT Gateway. This ensures the Lambda function can securely access the database inside the VPC and access external APIs over the internet.
Adım Adım Çözüm
Anahtar Kavram
VPC security and connectivity configurations for AWS Lambda, involving Security Groups and NAT Gateways.