Examkin

Soru

Zorluk: ZorServerless Development with AWS Lambda

A developer is deploying an AWS Lambda function that processes user sessions. The function must retrieve user profile data from an Amazon ElastiCache for Redis cluster located in a private subnet of a custom VPC. Additionally, the Lambda function needs to call the public AWS Secrets Manager API to retrieve database credentials. The developer configures the Lambda function's VPC settings with the private subnets and the security group of the VPC. During testing, the Lambda function successfully queries ElastiCache but times out when trying to call Secrets Manager. There are currently no VPC endpoints configured in the VPC.

How should the developer configure the VPC and Lambda settings to resolve this timeout issue?

  1. Create an interface VPC endpoint for Secrets Manager within the private subnets, or configure a NAT Gateway in a public subnet and route outbound traffic from the private subnets through the NAT Gateway.Cevap
  2. B
    Configure the Lambda function to run in the public subnets of the VPC and ensure the VPC has an attached Internet Gateway to allow direct outbound communication to the Secrets Manager endpoint.
  3. C
    Assign a public IP address to the Lambda function by enabling the auto-assign public IP setting on the Elastic Network Interfaces (ENIs) created by the Lambda service in the private subnets.
  4. D
    Update the Lambda function's IAM execution role to include Secrets Manager as a trusted entity in the trust policy and grant the secretsmanager:GetSecretValue permission.

Cevap

Create an interface VPC endpoint for Secrets Manager within the private subnets, or configure a NAT Gateway in a public subnet and route outbound traffic from the private subnets through the NAT Gateway.
The correct answer states that the developer should create an interface VPC endpoint or configure a NAT Gateway. This is correct because the network timeout indicates the Lambda function running inside a private subnet does not have a network path to the public Secrets Manager endpoint. An interface VPC endpoint creates private network interfaces inside the private subnets for Secrets Manager. Alternatively, routing the private subnets' outbound traffic to a NAT Gateway located in a public subnet provides internet access to reach the public endpoint.

Adım Adım Çözüm

1
Analyze the network timeout error during the Secrets Manager API call.
The Lambda function is deployed inside private subnets of a VPC and successfully communicates with the local ElastiCache cluster, indicating internal VPC routing is functional, but it cannot establish a route to the public internet.
Since the Lambda function resides inside a private subnet and has no access to the public internet or private endpoints for Secrets Manager, the outbound TCP handshake to the Secrets Manager public endpoint fails and times out.
2
Evaluate the subnet placement and IP constraints of AWS Lambda in a VPC.
Confirming that placing the Lambda function in public subnets will not resolve the issue, because Lambda functions do not receive public IPs and cannot route traffic through an Internet Gateway directly.
This rules out solutions that attempt to use public subnets or manually associate public IPs with the managed Elastic Network Interfaces.
3
Formulate a connectivity solution using either public egress or private endpoints.
Select either a NAT Gateway in a public subnet to route 0.0.0.0/00.0.0.0/0 outbound traffic from the private subnet to the internet, or provision an interface VPC endpoint (AWS PrivateLink) for Secrets Manager in the private subnets.
Both methods provide a valid routing path for the Lambda function to reach the Secrets Manager service endpoint without violating VPC security constraints.

Anahtar Kavram

AWS Lambda VPC networking and private endpoints
Bu soruyu puanla

Konular

Serverless Development with AWS Lambda

Bu konudan daha fazla soru