Examkin

Soru

Zorluk: ZorDebugging Lambda Execution and Configuration Issues

A developer is troubleshooting an AWS Lambda function that processes transaction files stored in an Amazon S3 bucket and updates a database running on an Amazon RDS MySQL DB instance. The RDS instance is deployed in 22 private subnets of a custom VPC.

To enable the Lambda function to access both Amazon S3 and the RDS instance, the developer configured the function to run within the VPC and associated it with the public subnets of the VPC. The Lambda function's security group is correctly allowed in the RDS security group's inbound rules.

During execution, the function fails with a timeout error. The logs show that the connection to the RDS DB instance is successful, but the function times out after 1515 seconds while attempting to connect to the Amazon S3 service endpoint.

Which two actions should the developer take to resolve this issue and follow AWS security best practices? (Select TWO.)

  1. Associate the Lambda function with the private subnets of the VPC instead of the public subnets.Cevap
  2. Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the subnets where the Lambda function is deployed.Cevap
  3. C
    Enable the 'Assign Public IP' configuration option on the Lambda function's network interface settings.
  4. D
    Attach an Elastic IP address directly to the Elastic Network Interfaces (ENIs) created by the Lambda function in the public subnets.
  5. E
    Increase the Lambda function's timeout configuration to a value greater than 3030 seconds to allow DNS resolution to complete.

Cevap

Associate the Lambda function with the private subnets of the VPC and create a Gateway VPC Endpoint for Amazon S3 associated with the route tables of those subnets.
To resolve the S3 timeout and secure the architecture, the developer must associate the Lambda function with the private subnets of the VPC and create a Gateway VPC Endpoint for Amazon S3. When a Lambda function is configured to run inside a VPC, it only receives private IP addresses on its Elastic Network Interfaces (ENIs). Consequently, it cannot route traffic to public AWS endpoints like Amazon S3 via the Internet Gateway, even if placed in a public subnet. Creating a Gateway VPC Endpoint for Amazon S3 allows the Lambda function to communicate with S3 over the private AWS network using the subnet's route tables. Moving the function to private subnets complies with security best practices.

Adım Adım Çözüm

1
Analyze the network route paths for a Lambda function configured inside a VPC.
Understand that Lambda functions inside a VPC are allocated Elastic Network Interfaces (ENIs) with private IP addresses only. They do not get public IPs even if associated with public subnets.
Explain why the connection to the RDS DB instance inside the VPC succeeded (local routing), but the connection to S3 (public endpoint) failed.
2
Evaluate the security and architecture best practices for deploying Lambda functions that access VPC resources.
Determine that the Lambda function should be moved from the public subnets to the private subnets.
Lambda functions should always be placed in private subnets when connected to a VPC to reduce the attack surface and align with the principle of least privilege.
3
Configure a private connectivity mechanism for the Lambda function to access Amazon S3.
Create an Amazon S3 Gateway VPC Endpoint and associate it with the route tables of the private subnets.
This allows traffic destined for S3 to be routed internally through the AWS network backbone instead of attempting to go over the public internet, resolving the timeout error.

Anahtar Kavram

AWS Lambda functions running inside a VPC do not receive public IP addresses. To access public AWS services like Amazon S3, they must use VPC endpoints (such as a Gateway VPC Endpoint for S3) or route traffic through a NAT Gateway in a public subnet. For security, Lambda functions should always be associated with private subnets rather than public subnets.
Bu soruyu puanla

Konular

Debugging Lambda Execution and Configuration Issues

Bu konudan daha fazla soru