Soru

Zorluk: KolayVPC Security for Developers

A serverless application needs to retrieve credentials from AWS Secrets Manager and query an Amazon RDS database located in a private VPC subnet. What network configuration should be implemented to allow the Lambda function to securely retrieve the credentials and access the database without exposing any traffic to the public internet?

  1. A
    Run the Lambda function in the private VPC subnets without any VPC endpoints or NAT gateways, as Lambda functions automatically bypass VPC routing to connect to public AWS service endpoints.
  2. B
    Store the database credentials in AWS Systems Manager Parameter Store and enable automatic rotation to allow the private Lambda function to retrieve them over standard HTTP.
  3. Attach the Lambda function to the private VPC subnets, configure an interface VPC endpoint for Secrets Manager, and permit inbound database security group traffic from the Lambda function's security group.Cevap
  4. D
    Modify the Lambda function's IAM role trust policy to allow public internet gateway access for database credentials validation.

Cevap

Attach the Lambda function to the private VPC subnets, configure an interface VPC endpoint for Secrets Manager, and permit inbound database security group traffic from the Lambda function's security group.
The correct configuration is to attach the Lambda function to the private subnets, set up an interface VPC endpoint for Secrets Manager to allow private API calls, and configure the RDS database's security group to allow inbound traffic from the Lambda function's security group. This achieves fully private, secure access for both credentials retrieval and database queries.

Adım Adım Çözüm

1
Configure the Lambda function to run inside the private subnets of the VPC.
The Lambda function gains private network access to VPC resources, including the RDS database in the same VPC.
This establishes private network routing to the database.
2
Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager inside the VPC.
A private network interface is placed in the subnets, routing traffic to Secrets Manager privately.
This allows the Lambda function to retrieve secrets without traversing the public internet.
3
Modify the RDS database's security group inbound rules to allow traffic on the database port from the Lambda function's security group.
The RDS database will accept connection requests initiated by the Lambda function.
This ensures secure access to the database using the principle of least privilege.

Anahtar Kavram

VPC endpoints and security groups for private AWS service and database connectivity from Lambda functions.
Bu soruyu puanla