Soru

Zorluk: KolayVPC Security for Developers

A developer is configuring an AWS Lambda function that runs inside a private subnet of a VPC. The Lambda function needs to connect to an Amazon RDS database in another private subnet and call an external third-party API over the public internet.

Which two network and security configurations are required to establish these connections?

  1. Configure the RDS security group to allow inbound traffic on the database port from the security group assigned to the Lambda function.Cevap
  2. Route traffic destined for the internet (0.0.0.0/00.0.0.0/0) from the Lambda function's private subnet through a NAT Gateway located in a public subnet.Cevap
  3. C
    Add a route pointing to an Internet Gateway (0.0.0.0/00.0.0.0/0) directly in the route table of the Lambda function's private subnet.
  4. D
    Modify the Lambda execution role's IAM trust policy to grant the database connection permission.
  5. E
    Store the database credentials in AWS Systems Manager Parameter Store and enable automatic rotation of the parameter to secure the connection.

Cevap

To establish the required connections, the RDS security group must be configured to allow inbound traffic on the database port from the Lambda function's security group, and a route to a NAT Gateway in a public subnet must be added to the private subnet's route table to allow outbound internet access for external API calls.
The correct configurations involve setting up an inbound security group rule on the RDS database that allows traffic from the Lambda function's security group, and routing internet-bound traffic from the private subnet to a NAT Gateway. This ensures the Lambda function can securely access the database inside the VPC and access external APIs over the internet.

Adım Adım Çözüm

1
Configure database security group rules.
The RDS security group is updated to allow inbound traffic on the database port, referencing the security group of the Lambda function as the source.
This establishes secure, restricted communication between the Lambda function and the RDS database without opening the database to the entire subnet.
2
Configure private subnet routing for internet access.
A route for 0.0.0.0/00.0.0.0/0 is added to the private subnet's route table, pointing to a NAT Gateway in a public subnet.
Since the Lambda function is in a private subnet and does not have a public IP address, it cannot access the internet directly. Routing traffic through a NAT Gateway allows outbound-only internet access to call external APIs.

Anahtar Kavram

VPC security and connectivity configurations for AWS Lambda, involving Security Groups and NAT Gateways.
Bu soruyu puanla