Examkin

Soru

Zorluk: OrtaVPC Security for Developers

A developer is deploying an AWS Lambda function that processes transaction requests. The function is configured to run within the private subnets of a custom VPC. The Lambda function must connect to a private Amazon RDS PostgreSQL database cluster in the same VPC, call a public API endpoint of an external payment provider, and retrieve parameters from AWS Systems Manager Parameter Store. Which two network and security configurations should the developer implement to enable this connectivity? (Select two.)

  1. Configure the RDS database security group to allow inbound TCP traffic on port 54325432 from the security group associated with the Lambda function.Cevap
  2. Configure a route in the private subnet route table pointing 0.0.0.0/00.0.0.0/0 to a NAT Gateway deployed in a public subnet.Cevap
  3. C
    Enable public IP assignment on the Lambda function and configure a route in the private subnet route table pointing 0.0.0.0/00.0.0.0/0 to the Internet Gateway.
  4. D
    Modify the trust policy of the Lambda function's IAM execution role to allow the rds.amazonaws.com service principal to assume the role.
  5. E
    Migrate the configurations to AWS Secrets Manager to utilize a Gateway VPC Endpoint for database and external API routing.

Cevap

To enable connectivity, the developer must allow inbound TCP traffic on port 54325432 from the Lambda function's security group in the RDS database's security group, and configure a route in the private subnet route table directing outbound internet traffic (0.0.0.0/00.0.0.0/0) to a NAT Gateway deployed in a public subnet.
To connect the Lambda function to the RDS database, the database security group must explicitly allow inbound traffic from the security group associated with the Lambda function. Additionally, since the Lambda function runs in a private VPC subnet, it cannot access external endpoints directly. Configuring a route pointing to a NAT Gateway in a public subnet allows the Lambda function to route traffic to the external payment API and Systems Manager Parameter Store.

Adım Adım Çözüm

1
Configure the security group of the destination database to permit inbound traffic from the source.
The RDS database cluster security group is updated with a rule allowing inbound TCP traffic on port 54325432 from the Lambda function's security group.
Since both resources reside within the same VPC, communication is routed locally but must be explicitly permitted by the database's security group.
2
Configure outbound routing for external internet endpoints and public AWS services.
A route is added to the private subnet route table directing 0.0.0.0/00.0.0.0/0 traffic to a NAT Gateway deployed in a public subnet.
Lambda functions inside private VPC subnets do not have public IP addresses and cannot connect directly to an Internet Gateway. A NAT Gateway translates their addresses and forwards traffic to the public internet, enabling access to the payment provider API and Systems Manager Parameter Store.

Anahtar Kavram

VPC security group rules and routing configurations for Lambda functions in private subnets.
Bu soruyu puanla

Konular

VPC Security for Developers

Bu konudan daha fazla soru