Examkin

Soru

Zorluk: OrtaVPC Security for Developers

An organization requires a new microservice backend to run on AWS Lambda within a custom VPC. The function must query an Amazon Aurora MySQL database residing in a private subnet. The function also needs to retrieve database credentials from AWS Secrets Manager without any traffic transiting the public internet.

Which configuration should a developer implement to meet these requirements securely?

  1. A
    Associate the Lambda function with the private subnets. Deploy a NAT Gateway in a public subnet, and configure the route table of the private subnets to send internet-bound traffic to the NAT Gateway.
  2. Associate the Lambda function with the private subnets. Provision an interface VPC endpoint for Secrets Manager in the VPC, and configure the security groups to allow inbound HTTPS traffic from the Lambda function's security group to the endpoint.Cevap
  3. C
    Associate the Lambda function with the private subnets. Store the credentials in Systems Manager Parameter Store, and set up a gateway VPC endpoint to route API calls directly to Parameter Store.
  4. D
    Configure the Lambda function execution role trust policy to trust the Secrets Manager service principal, and assign an IAM policy allowing access to Secrets Manager.

Cevap

Associate the Lambda function with the private subnets. Provision an interface VPC endpoint for Secrets Manager in the VPC, and configure the security groups to allow inbound HTTPS traffic from the Lambda function's security group to the endpoint.
The correct solution involves associating the Lambda function with the private subnets where the database resides and provisioning an interface VPC endpoint for Secrets Manager. The security groups are then configured to allow inbound HTTPS traffic from the Lambda function to the endpoint. This satisfies all requirements: Lambda can query the Aurora database, and the credentials from Secrets Manager are retrieved securely over private IP addresses within the AWS network without transiting the public internet.

Adım Adım Çözüm

1
Associate the Lambda function with the private subnets of the VPC.
The Lambda function receives elastic network interfaces (ENIs) inside the private subnets, enabling network connectivity to the Aurora database.
By default, Lambda functions run in a secure service VPC and cannot access resources in a customer's private subnets unless VPC association is configured.
2
Provision an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC.
Private IP addresses are allocated in the private subnets for the endpoint, resolving hostnames privately within the VPC.
An interface VPC endpoint is required to access AWS Secrets Manager without routing requests through a NAT Gateway or transiting the public internet.
3
Configure the security groups of the interface VPC endpoint to allow inbound HTTPS (port 443) traffic from the Lambda function's security group.
The firewall rules are updated to permit secure HTTPS connections from the Lambda function to the Secrets Manager endpoint.
Interface VPC endpoints use security groups to restrict network access, and they must explicitly permit incoming traffic from the clients.

Anahtar Kavram

VPC endpoints enable private connection between a VPC and supported AWS services without requiring internet gateways, NAT devices, or VPN connections. Security groups must be configured to allow communication between resources and interface endpoints.
Bu soruyu puanla

Konular

VPC Security for Developers

Bu konudan daha fazla soru