Examkin

Soru

Zorluk: KolayVPC Security for Developers

A developer is configuring an AWS Lambda function that runs inside a private subnet of a VPC. The Lambda function needs to securely download external libraries from a public repository on the internet and retrieve configuration parameters from AWS Systems Manager Parameter Store. Which of the following VPC configurations are required to meet these requirements? (Select TWO.)

  1. Configure a route in the private subnet's route table that directs outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet.Cevap
  2. Create an Interface VPC Endpoint (AWS PrivateLink) for Systems Manager (ssm) and associate it with the private subnets.Cevap
  3. C
    Deploy the Lambda function directly in a public subnet with an attached Internet Gateway to allow direct outbound internet access.
  4. D
    Store the registry access credentials in AWS Systems Manager Parameter Store and enable native automatic secret rotation.
  5. E
    Modify the IAM trust policy of the Lambda execution role to allow the Systems Manager service principal (ssm.amazonaws.com) to assume the role.

Cevap

Configure a route in the private subnet's route table that directs outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet, and create an Interface VPC Endpoint (AWS PrivateLink) for Systems Manager (ssm) associated with the private subnets.
The correct configurations involve routing private subnet outbound internet traffic to a NAT Gateway in a public subnet, and establishing an Interface VPC Endpoint for Systems Manager. This allows the Lambda function to securely communicate with both the public internet and AWS Systems Manager privately.

Adım Adım Çözüm

1
Analyze internet access requirements for Lambda in a private subnet.
To access the public internet (external registry), a Lambda function in a private subnet requires a route targeting a NAT Gateway located in a public subnet.
Resources in private subnets cannot associate with public IP addresses directly, so egress to the internet must be handled by a Network Translation (NAT) device.
2
Analyze private access to AWS Systems Manager.
Create an Interface VPC Endpoint (PrivateLink) for 'ssm' and map it to the private subnets.
This establishes a secure, private connection to Systems Manager within the VPC without routing traffic through the public internet.

Anahtar Kavram

VPC Egress and VPC Endpoints for Lambda
Bu soruyu puanla

Konular

VPC Security for Developers

Bu konudan daha fazla soru