Examkin

Soru

Zorluk: OrtaServerless Development with AWS Lambda

An application processes file uploads from an Amazon S3 bucket using an AWS Lambda function. The function needs to write data to an Amazon RDS database located in a private subnet of an Amazon VPC, and also send status updates to an external third-party API. The function is configured to run inside the same private VPC subnet. During testing, the function successfully writes to the database but fails with network timeouts when calling the external API. Which configuration change will resolve this issue?

  1. Configure the Lambda function to use private subnets that have a route to a NAT Gateway in a public subnet of the VPC.Cevap
  2. B
    Associate the Lambda function with the public subnets of the VPC to allow direct outbound access through the Internet Gateway.
  3. C
    Increase the execution timeout of the Lambda function to 15 minutes to allow sufficient time for the connection to the external API to establish.
  4. D
    Modify the trust policy of the Lambda function's IAM execution role to allow the external third-party API service to assume the role.

Cevap

Configure the Lambda function to use private subnets that have a route to a NAT Gateway in a public subnet of the VPC.
When a Lambda function is configured to connect to a VPC, it does not have direct access to the internet. To allow the function to connect to both the RDS database in the private subnet and the external third-party API, the function must be configured to run in private subnets. The routing table for these private subnets must include a route directing internet-bound traffic (0.0.0.0/0) to a NAT Gateway that is situated in a public subnet of the VPC.

Adım Adım Çözüm

1
Analyze the network configuration of the Lambda function.
The function is attached to a private subnet in a VPC to communicate with Amazon RDS. This configuration removes the default internet access path for the function.
Understanding the current network environment is necessary to diagnose why external endpoints are unreachable.
2
Determine the required route for internet access from within a VPC subnet.
For resources inside a private subnet to access the internet, outbound traffic must route through a NAT Gateway or NAT Instance placed in a public subnet, which in turn connects to the Internet Gateway.
This establishes a valid network egress path for the Lambda function's ENIs.
3
Apply the subnet routing rules to the Lambda function configuration.
Ensure the Lambda function is mapped to the private subnets, and that the routing table associated with these private subnets contains a route of 0.0.0.0/0 pointing to the NAT Gateway.
This configuration satisfies both requirements: local routing to the RDS database and egress routing to the external API.

Anahtar Kavram

AWS Lambda VPC networking and outbound internet access
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Serverless Development with AWS Lambda

Bu konudan daha fazla soru