Examkin

Soru

Zorluk: OrtaVPC Security for Developers

A developer is configuring an AWS Lambda function to run inside a private subnet of a custom VPC. The function must retrieve configuration parameters from Systems Manager Parameter Store and send trace data to AWS X-Ray. Due to strict compliance guidelines, the VPC does not have a NAT Gateway or an Internet Gateway. Which two configurations must the developer implement to enable this connectivity? (Select TWO.)

  1. Create an interface VPC endpoint for Systems Manager (com.amazonaws.region.ssm) and associate it with the private subnets.Cevap
  2. Create an interface VPC endpoint for AWS X-Ray (com.amazonaws.region.xray) and associate it with the private subnets.Cevap
  3. C
    Provision a NAT Gateway inside the private subnet, and update the private subnet's route table to direct 0.0.0.0/0 traffic to it.
  4. D
    Configure the Lambda function to retrieve values from AWS Secrets Manager using a gateway VPC endpoint.
  5. E
    Update the trust policy of the Lambda function's IAM execution role to trust the VPC endpoint service principal.

Cevap

Create interface VPC endpoints for Systems Manager (com.amazonaws.region.ssm) and AWS X-Ray (com.amazonaws.region.xray) and associate them with the private subnets.
Because the Lambda function is deployed inside a private subnet without internet egress (no NAT Gateway or Internet Gateway), it cannot resolve and reach the public API endpoints of Systems Manager and AWS X-Ray. Implementing interface VPC endpoints (AWS PrivateLink) creates private elastic network interfaces (ENIs) with private IP addresses directly inside the private subnet. This routes traffic privately to the specified AWS services without exposing data to the public internet.

Adım Adım Çözüm

1
Identify the destination services needed by the Lambda function.
The function must reach AWS Systems Manager (SSM) Parameter Store and AWS X-Ray.
This establishes the specific AWS service endpoints that require network pathways.
2
Select the correct connectivity mechanism for a VPC without internet egress (no NAT Gateway or Internet Gateway).
Determine that interface VPC endpoints (AWS PrivateLink) are required for SSM and X-Ray since gateway endpoints are not supported for these services.
AWS PrivateLink provisions private ENIs inside the subnets to route traffic locally and securely over the AWS network.
3
Configure the interface endpoints for com.amazonaws.region.ssm and com.amazonaws.region.xray.
The Lambda function inside the private subnet can now resolve these service endpoints to private IP addresses and successfully connect.
This establishes the necessary network endpoints for secure internal service resolution.

Anahtar Kavram

AWS PrivateLink and Interface VPC Endpoints for private AWS service communication
Bu soruyu puanla

Konular

VPC Security for Developers

Bu konudan daha fazla soru