Examkin

Soru

Zorluk: OrtaServerless Development with AWS Lambda

A team is migrating an on-premises batch utility to run as an AWS Lambda function inside a custom VPC. The function must connect to a database running on an Amazon RDS instance within the private subnets of the VPC. Additionally, the function needs to fetch static configuration files from Amazon S3 and make API calls to an external payment processor over the internet. During initial testing, the Lambda function succeeds in connecting to the database but experiences connection timeouts when trying to access S3 and the external payment processor.

Which of the following actions should the developer take to resolve these connectivity issues? (Select two.)

  1. Configure a NAT Gateway in a public subnet of the VPC, and update the private subnet's route table to route `0.0.0.0/00.0.0.0/0` traffic to the NAT Gateway.Cevap
  2. Create a Gateway VPC Endpoint for Amazon S3, and associate it with the route table of the private subnet where the Lambda function resides.Cevap
  3. C
    Move the Lambda function configuration to a public subnet of the VPC and enable the auto-assign public IP setting on the function.
  4. D
    Update the Lambda function's trust policy to grant `s3:GetObject` permission for the S3 bucket configuration path.
  5. E
    Embed AWS access key credentials directly within the Lambda function code to bypass VPC routing for the S3 SDK client calls.

Cevap

To resolve the connectivity issues, the developer must configure a NAT Gateway in a public subnet to allow internet-bound traffic from the private subnet, and create a Gateway VPC Endpoint for Amazon S3 to enable private direct communication with S3.
To allow the Lambda function in the private subnet to connect to external services over the internet, a NAT Gateway must be deployed in a public subnet and the private subnet's route table updated to route internet-bound traffic (represented by the `0.0.0.0/00.0.0.0/0` route) to the NAT Gateway. Additionally, to access Amazon S3 without routing traffic through the NAT Gateway (which incurs extra cost and processing overhead), a Gateway VPC Endpoint for Amazon S3 should be created and associated with the private subnet's route table. This enables direct, private connectivity to S3.

Adım Adım Çözüm

1
Analyze the VPC deployment model for the Lambda function.
The Lambda function is associated with private subnets in the VPC, which allows it to connect to the Amazon RDS instance in the same VPC but isolates it from external networks, including the internet and default public AWS endpoints.
Understanding why the connection timeouts are occurring is the first step in troubleshooting VPC networking.
2
Establish internet access for the Lambda function to reach the external payment processor.
By placing a NAT Gateway in a public subnet and routing the private subnet's `0.0.0.0/00.0.0.0/0` traffic to the NAT Gateway, the Lambda function can securely send egress traffic to the internet.
Lambda functions inside private subnets cannot communicate with the internet directly and require a NAT device to map private IPs to a public IP.
3
Establish direct private connectivity to Amazon S3.
By creating a Gateway VPC Endpoint for Amazon S3 and linking it to the private subnet's route table, traffic destined for S3 is routed directly to the S3 service within the AWS network.
Using a VPC endpoint avoids sending S3 traffic through the NAT Gateway, which saves costs and prevents potential network bandwidth bottlenecks.

Anahtar Kavram

VPC Networking for AWS Lambda and Private Service Access
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Serverless Development with AWS Lambda

Bu konudan daha fazla soru