Examkin

Soru

Zorluk: OrtaVPC Security for Developers

A developer has configured an AWS Lambda function to run inside the private subnets of a VPC so that it can securely query an Amazon RDS PostgreSQL DB instance. The Lambda function also needs to write application execution logs to an Amazon DynamoDB table. During testing, the Lambda function successfully queries the database but times out when trying to write to DynamoDB.

Which configuration change will resolve this connection issue in the most secure and cost-effective manner?

  1. A
    Move the Lambda function to the public subnets of the VPC and enable the public IP assignment setting in the VPC configuration.
  2. Create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets.Cevap
  3. C
    Update the Lambda function's IAM execution role trust policy to allow the DynamoDB service principal to assume the role.
  4. D
    Store the DynamoDB connection metadata in AWS Secrets Manager instead of Systems Manager Parameter Store and configure automatic rotation.

Cevap

Create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets.
The correct answer is to create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets. A Gateway VPC Endpoint allows private subnets within a VPC to establish a secure, private connection to DynamoDB. The traffic remains within the AWS network, which avoids NAT Gateway processing fees, hourly charges, and the need for public IP addresses or internet routing, making it the most cost-effective and secure solution.

Adım Adım Çözüm

1
Analyze the timeout error occurring during the DynamoDB call.
Determine that the Lambda function in the private subnet lacks a network route to public AWS services.
Lambda functions in private subnets cannot access public AWS endpoints directly without a NAT Gateway or a VPC Endpoint.
2
Compare connectivity options for accessing DynamoDB from the private subnet.
Identify that a Gateway VPC Endpoint is the most secure and cost-effective method to route traffic directly to DynamoDB.
VPC Endpoints route traffic over the private AWS network, avoiding the data transfer and hourly costs associated with NAT Gateways.
3
Configure the Gateway VPC Endpoint for DynamoDB.
Associate the endpoint with the route tables of the private subnets where the Lambda function resides.
Associating the endpoint adds the prefix list route to the subnet route tables, allowing traffic to DynamoDB to be routed through the endpoint.

Anahtar Kavram

VPC Endpoint configuration for secure and private access to AWS services from private subnets.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

VPC Security for Developers

Bu konudan daha fazla soru