A serverless application needs to retrieve credentials from AWS Secrets Manager and query an Amazon RDS database located in a private VPC subnet. What network configuration should be implemented to allow the Lambda function to securely retrieve the credentials and access the database without exposing any traffic to the public internet?
- ARun the Lambda function in the private VPC subnets without any VPC endpoints or NAT gateways, as Lambda functions automatically bypass VPC routing to connect to public AWS service endpoints.
- BStore the database credentials in AWS Systems Manager Parameter Store and enable automatic rotation to allow the private Lambda function to retrieve them over standard HTTP.
- Attach the Lambda function to the private VPC subnets, configure an interface VPC endpoint for Secrets Manager, and permit inbound database security group traffic from the Lambda function's security group.Cevap
- DModify the Lambda function's IAM role trust policy to allow public internet gateway access for database credentials validation.
Cevap
Attach the Lambda function to the private VPC subnets, configure an interface VPC endpoint for Secrets Manager, and permit inbound database security group traffic from the Lambda function's security group.
The correct configuration is to attach the Lambda function to the private subnets, set up an interface VPC endpoint for Secrets Manager to allow private API calls, and configure the RDS database's security group to allow inbound traffic from the Lambda function's security group. This achieves fully private, secure access for both credentials retrieval and database queries.
Adım Adım Çözüm
Anahtar Kavram
VPC endpoints and security groups for private AWS service and database connectivity from Lambda functions.