Examkin

Soru

Zorluk: OrtaVPC Security for Developers

A developer is configuring an AWS Lambda function inside a private subnet of a VPC. The Lambda function needs to read messages from an Amazon SQS queue and write records to an Amazon ElastiCache for Redis cluster located in another private subnet within the same VPC. The Lambda function is successfully writing to ElastiCache but is unable to connect to the Amazon SQS service. Which configuration change should the developer make to resolve this connectivity issue in the most secure manner?

  1. A
    Modify the IAM trust policy of the Lambda function's execution role to include the Amazon SQS service principal (sqs.amazonaws.com) as a trusted entity.
  2. B
    Move the Lambda function to a public subnet within the VPC to allow it to communicate directly with the public Amazon SQS endpoints.
  3. Create an interface VPC endpoint for Amazon SQS in the VPC, and update the security groups to allow traffic between the Lambda function and the endpoint.Cevap
  4. D
    Store the SQS queue URL in AWS Secrets Manager, and configure the Lambda function to retrieve it using the Secrets Manager API to bypass the network route.

Cevap

Create an interface VPC endpoint for Amazon SQS in the VPC, and update the security groups to allow traffic between the Lambda function and the endpoint.
Creating an interface VPC endpoint (powered by AWS PrivateLink) for Amazon SQS allows resources in private subnets to communicate privately with the service without traversing the public internet or needing a NAT Gateway. Since the Lambda function is in a private subnet, it can route SQS traffic through this private endpoint.

Adım Adım Çözüm

1
Identify the destination endpoint requirements.
Amazon SQS is a public AWS service, which means a resource inside a private subnet without internet access cannot reach it directly.
The Lambda function needs a path to reach the public SQS API, which can be accomplished either via public internet routing (NAT Gateway) or a private path (VPC endpoint).
2
Select the most secure connectivity method that does not expose the traffic to the public internet.
An Interface VPC Endpoint for SQS (com.amazonaws.region.sqs) provides private, secure connectivity.
VPC endpoints use AWS PrivateLink to keep traffic within the AWS network, satisfying the security requirement.
3
Update security groups and routing to allow traffic.
Ensure the Lambda function's security group allows outbound traffic to the VPC endpoint, and the endpoint's security group allows inbound HTTPS traffic from the Lambda function.
Security groups are stateful and must explicitly allow the connection from the client to the endpoint.

Anahtar Kavram

Establishing private connectivity to public AWS services from within a VPC using Interface VPC Endpoints (AWS PrivateLink).
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

VPC Security for Developers

Bu konudan daha fazla soru