Examkin

Soru

Zorluk: OrtaVPC Security for Developers

A developer is implementing a database maintenance task using an AWS Lambda function. The function is configured to run within a private subnet of a custom VPC in order to access an Amazon RDS DB instance. The database credentials must be retrieved securely from AWS Secrets Manager. During testing, the Lambda function successfully queries the database but fails when trying to retrieve credentials from the Secrets Manager endpoint. Which action should the developer take to resolve this connection failure?

  1. Create an interface VPC endpoint for Secrets Manager, and configure the Lambda function's security group to allow outbound HTTPS traffic to the endpoint's security group.Cevap
  2. B
    Associate the Lambda function with the VPC's public subnets to allow direct outbound access to the public Secrets Manager endpoint without requiring a NAT Gateway or VPC endpoints.
  3. C
    Update the Lambda function's execution role to include an IAM trust policy that explicitly grants assume role permissions to the VPC's security groups.
  4. D
    Move the database credentials from Secrets Manager to Systems Manager Parameter Store, which is natively reachable from private VPC subnets without VPC endpoints or internet connectivity.

Cevap

Create an interface VPC endpoint for Secrets Manager, and configure the Lambda function's security group to allow outbound HTTPS traffic to the endpoint's security group.
Creating an interface VPC endpoint for Secrets Manager allows resources in private subnets to securely connect to the service via PrivateLink, avoiding the public internet. The security group of the Lambda function must allow outbound HTTPS traffic to the endpoint's IP addresses to establish this connection.

Adım Adım Çözüm

1
Analyze the network path requirements.
The Lambda function is running in a private VPC subnet and needs to access AWS Secrets Manager, which is a public service.
Since the VPC lacks a NAT Gateway or internet path, the function cannot reach public endpoints.
2
Select the correct VPC security integration pattern.
Create an interface VPC endpoint (powered by AWS PrivateLink) for Secrets Manager inside the VPC.
This provides a private network path from the VPC subnets to the AWS service using private IP addresses.
3
Configure the security groups.
Allow outbound traffic from the Lambda function's security group to the VPC endpoint on HTTPS port 443.
Security groups are stateful and must allow outbound connections to initiate the handshake.

Anahtar Kavram

VPC Endpoint integration for accessing public AWS services privately from within private subnets.
Bu soruyu puanla

Konular

VPC Security for Developers

Bu konudan daha fazla soru