Examkin

Soru

Zorluk: OrtaDebugging Lambda Execution and Configuration Issues

A reporting service executes an AWS Lambda function residing in private VPC subnets to generate PDF documents. The function must fetch raw data from an Amazon S3 bucket, compile the PDF, and then register the document ID by making an HTTPS request to an external registry API. Under the current configuration, the Lambda function consistently fails to connect to both Amazon S3 and the external registry API, resulting in connection timeout errors.

Which two network modifications should the developer implement to enable successful execution? (Select TWO.)

  1. Create a Gateway VPC Endpoint for Amazon S3 in the VPC and associate it with the route tables of the Lambda function's subnets.Cevap
  2. Provision a NAT Gateway in a public subnet, and add a route in the private subnet route tables that directs Internet-bound traffic (0.0.0.0/0) to the NAT Gateway.Cevap
  3. C
    Configure an Internet Gateway in the VPC, and add a route directing 0.0.0.0/0 to the Internet Gateway in the Lambda function's private subnet route tables.
  4. D
    Configure the Lambda function's VPC settings to assign a public IPv4 address to the function's elastic network interfaces (ENIs) automatically.
  5. E
    Increase the execution timeout value of the Lambda function to 15 minutes to allow enough time for TCP connection retries to complete.

Cevap

Create a Gateway VPC Endpoint for Amazon S3 in the VPC and associate it with the route tables of the Lambda function's subnets, and provision a NAT Gateway in a public subnet, and add a route in the private subnet route tables that directs Internet-bound traffic to the NAT Gateway.
To allow a Lambda function running inside private VPC subnets to reach public resources, proper routing must be configured. For Amazon S3, configuring a Gateway VPC Endpoint enables the function to access S3 privately through the AWS network. For the external HTTP registry API, the function's traffic must be routed via a NAT Gateway located in a public subnet, which translates the private IP addresses of the Lambda ENIs to a public IP to enable internet access.

Adım Adım Çözüm

1
Analyze the destination of the outbound traffic.
The Lambda function needs to connect to Amazon S3 (a public AWS service) and an external third-party registry API over the internet.
Identifying the distinct destinations allows for mapping the required VPC routing configurations.
2
Configure routing for Amazon S3.
A Gateway VPC Endpoint for S3 is configured, and route tables are updated to direct S3 traffic (via prefix lists) through the endpoint.
This establishes a private, cost-effective route to Amazon S3 without requiring internet access.
3
Configure routing for the external HTTPS API.
A NAT Gateway is deployed in a public subnet, and the private subnet route tables are updated to point default traffic (0.0.0.0/0) to the NAT Gateway.
Because Lambda ENIs only have private IP addresses, they require a NAT Gateway to perform network address translation and reach external endpoints.

Anahtar Kavram

VPC routing requirements for AWS Lambda functions executing in private subnets needing S3 and public internet access
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Debugging Lambda Execution and Configuration Issues

Bu konudan daha fazla soru