An enterprise application requires a backend component to process payment transactions. A software engineer is designing an AWS Lambda function that must connect to a PostgreSQL database hosted inside a private VPC subnet, and also make HTTPS requests to an external payment processor's public API endpoint. Which configuration should the software engineer implement to meet these requirements?
- AConfigure the Lambda function to run in the public subnets of the VPC, and route outbound internet traffic through an Internet Gateway.
- BConfigure the Lambda function to run outside the VPC, and use an IAM trust policy to authorize secure access to the private database's IP address.
- Configure the Lambda function to run in the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway placed in a public subnet.Cevap
- DConfigure the Lambda function to run in the private subnets of the VPC, and use a VPC Gateway Endpoint to route traffic to the external payment processor's API.
Cevap
Configure the Lambda function to run in the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway placed in a public subnet.
To access both a private VPC resource (the database) and a public API, the Lambda function must be associated with the private subnets of the VPC. Since Lambda functions inside a VPC are not assigned public IP addresses, they cannot communicate directly with the internet via an Internet Gateway. Instead, outbound internet traffic must be routed from the private subnets to a NAT Gateway situated in a public subnet of the VPC.
Adım Adım Çözüm
Anahtar Kavram
VPC Networking for AWS Lambda