Troubleshooting and Optimization

271 soru

Tüm türler271 Çoktan seçmeli138 Çoklu seçim133

A developer has deployed a containerized application to Amazon ECS on AWS Fargate. The application code needs to retrieve customer records from an Amazon DynamoDB table. During execution, the container logs display an AccessDeniedException when attempting to call DynamoDB API operations. The developer verifies that the ECS task execution role has an attached policy allowing the necessary DynamoDB permissions. How should the developer resolve this authorization failure?

Ensure the DynamoDB policy is attached to the ECS task execution role and configure the container definition to enable runtime credential sharing.

Attach the DynamoDB permission policy to the ECS task role instead of the ECS task execution role.

Modify the trust relationship of the ECS task execution role to allow the DynamoDB service to assume the role.

Configure an Amazon Cognito Identity Pool to exchange credentials for the container and map them to the task execution role.

Cevabı ve açıklamayı göster

Cevap: Attach the DynamoDB permission policy to the ECS task role instead of the ECS task execution role.

Cevap

Attach the DynamoDB permission policy to the ECS task role instead of the ECS task execution role.

The correct answer is correct because the ECS task role is designed specifically to grant AWS API permissions to the application code running inside containerized tasks. The ECS task execution role is intended for the container agent itself to pull images from Amazon ECR and push logs to CloudWatch.

Adım Adım Çözüm

Distinguish between ECS Task Role and ECS Task Execution Role.

Identify that the Task Role is used by the application code running inside the container, whereas the Task Execution Role is used by the ECS container agent for infrastructure tasks (like pulling ECR images and writing CloudWatch logs).

Correctly identifying which identity runs the application code is necessary to assign API permissions.

Review the current IAM policy attachment.

Verify that the policy permitting DynamoDB actions is attached to the Task Execution Role, which explains why the application receives an AccessDeniedException.

Locating where the permission is incorrectly applied helps determine the required fix.

Migrate the permission policy to the ECS Task Role.

The application code is now successfully authorized to query the DynamoDB table.

Attaching permissions to the Task Role grants the running container the access credentials it needs.

Anahtar Kavram

ECS Task Role vs. ECS Task Execution Role

Soru 82Soru →

An AWS Lambda function is configured with an execution role named `LambdaProcessingRole`. The role has the following identity-based permission policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:PutItem",
"sns:Publish"
],
"Resource": "*"
}
]
}

Additionally, the developer has attached an IAM Permissions Boundary named `DeveloperBoundary` to the role. The policy document for the permissions boundary is:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:*",
"s3:*"
],
"Resource": "*"
}
]
}

During execution, the Lambda function successfully writes items to the Amazon DynamoDB table, but attempts to publish messages to the Amazon SNS topic fail with an `AccessDeniedException` error.

Which of the following modifications is required to resolve this authorization failure?

Modify the IAM trust policy of the Lambda execution role to allow sns.amazonaws.com to assume the role.

Update the permissions boundary policy (DeveloperBoundary) to include the sns:Publish action.

Hardcode the AWS credentials of an IAM User with AdministratorAccess in the initialization of the SNS client inside the Lambda code.

Configure a Cognito Identity Pool to authenticate the Lambda function and exchange the user tokens for temporary AWS credentials that have SNS publish permissions.

Cevabı ve açıklamayı göster

Cevap: Update the permissions boundary policy (DeveloperBoundary) to include the sns:Publish action.

Cevap

Update the permissions boundary policy (DeveloperBoundary) to include the sns:Publish action.

For any IAM entity with a permissions boundary, AWS evaluates permissions based on the intersection of the identity-based policy and the boundary policy. Since the permissions boundary policy in this scenario does not allow any SNS actions, the Lambda function's execution role is denied the ability to publish to the SNS topic, even though its identity-based policy allows it. Updating the permissions boundary to allow the sns:Publish action resolves the failure.

Adım Adım Çözüm

Identify that the Lambda function execution role has both an identity-based policy and a permissions boundary attached.

The identity-based policy allows both DynamoDB and SNS actions, but the permissions boundary only allows DynamoDB and S3 actions.

An IAM permissions boundary limits the maximum permissions that can be granted by identity-based policies to the user or role.

Evaluate the intersection of allowed actions between the identity-based policy and the permissions boundary.

The intersection allows dynamodb:PutItem, but does not allow sns:Publish because sns:Publish is missing from the permissions boundary.

For an action to be authorized, it must be allowed by both policies.

Determine the necessary change to allow sns:Publish.

Modify the permissions boundary (DeveloperBoundary) to include the sns:Publish action.

This updates the maximum allowed permission threshold, allowing the identity-based permission policy to take effect for SNS publishing.

Anahtar Kavram

IAM Permissions Boundary evaluation logic

Soru 83Soru →

A developer deploys a new AWS Lambda function configured with the default timeout of $3$ seconds to process image uploads. During testing with larger image files, the function execution fails and logs a task timeout error. Additionally, the developer notices that no log groups or log streams are being created in Amazon CloudWatch Logs for this function. Which two configuration changes should the developer make to resolve these issues?

Geçerli olan tümünü seçin

Increase the timeout configuration setting of the Lambda function.

Add permissions for `logs:CreateLogStream` and `logs:PutLogEvents` to the Lambda function's IAM execution role.

Configure the Lambda function to run inside a VPC public subnet to allow outbound access to the CloudWatch service endpoints.

Increase the memory allocation of the Lambda function, which automatically raises the timeout threshold proportionally.

Modify the IAM trust policy of the execution role to allow the CloudWatch Logs service principal to assume the role.

Cevabı ve açıklamayı göster

Cevap: Increase the timeout configuration setting of the Lambda function.; Add permissions for `logs:CreateLogStream` and `logs:PutLogEvents` to the Lambda function's IAM execution role.

Cevap

To resolve these issues, the developer must increase the Lambda function's timeout setting and grant the execution role permission to write to CloudWatch Logs.

To resolve the execution failures, the developer must increase the function's timeout setting. To resolve the logging failures, the developer must add permission for log operations (specifically `logs:CreateLogStream` and `logs:PutLogEvents`) to the Lambda function's IAM execution role.

Adım Adım Çözüm

Analyze the timeout symptom and identify that the default limit of

3

seconds is being exceeded, requiring an increase in the function's timeout configuration.

The execution timeout is adjusted to a higher value (e.g.,

30

seconds).

This prevents premature termination during the processing of larger payloads.

Analyze the logging symptom and identify that the Lambda function's IAM execution role lacks permissions to write logs to CloudWatch.

The IAM policy associated with the execution role is updated.

Adding permissions for log stream creation and event delivery allows Lambda to output logs to CloudWatch.

Anahtar Kavram

AWS Lambda basic configuration limits and IAM execution role permissions

Soru 84Soru →

A development team has deployed a microservice using AWS Lambda. The function is associated with private subnets in a custom VPC so it can securely access an internal Amazon Aurora MySQL database. Additionally, this function must send transaction logs to a public SaaS logging endpoint. While the database operations are performing correctly, all attempts to connect to the external SaaS endpoint result in timeout errors. How can this connectivity issue be resolved?

Set up a NAT Gateway within a public subnet, and update the route table of the private subnets to forward traffic destined for 0.0.0.0/0 to the NAT Gateway.

Associate the function with the public subnets of the VPC and enable the auto-assign public IP setting on those subnets.

Add a route in the route table of the private subnets that routes all traffic destined for 0.0.0.0/0 directly to the VPC's Internet Gateway.

Increase the function's execution timeout to the maximum limit and modify the code to initialize the database connection pool globally outside the handler function.

Cevabı ve açıklamayı göster

Cevap: Set up a NAT Gateway within a public subnet, and update the route table of the private subnets to forward traffic destined for 0.0.0.0/0 to the NAT Gateway.

Cevap

Set up a NAT Gateway within a public subnet, and update the route table of the private subnets to forward traffic destined for 0.0.0.0/0 to the NAT Gateway.

For a Lambda function associated with a VPC to access the public internet, it must be placed in private subnets with a route to a NAT Gateway in a public subnet. The NAT Gateway then forwards the traffic to the Internet Gateway. This allows the Lambda function to maintain connectivity to both the internal database (via local VPC routing) and the external endpoint.

Adım Adım Çözüm

Analyze the network paths for the two destinations.

Database access succeeds because it is local to the VPC, but SaaS endpoint access fails because there is no route to the internet from the private subnets.

Identify if the block is due to local VPC routing or internet routing.

Evaluate how Lambda handles internet access inside a VPC.

Lambda requires a NAT Gateway or VPC endpoint because its network interfaces do not get public IPs, preventing direct Internet Gateway usage.

Determine the required network translation component.

Formulate the correct routing rules.

Place a NAT Gateway in a public subnet and route 0.0.0.0/0 from the private subnet's route table to the NAT Gateway.

Establish outbound routing for the private resources.

Anahtar Kavram

VPC networking for AWS Lambda functions requiring internet access

Soru 85Soru →

A developer designs an AWS Lambda function to process event logs. To track processed message IDs within a test execution, the developer declares a global list variable `processed_ids = []` outside the Lambda handler function. During testing, the developer observes that subsequent invocations of the function run slower, eventually timing out, and contain data from previous invocations. Which of the following explains why this issue is occurring?

AWS Lambda reuses the execution context for subsequent invocations, causing the global list variable to persist and continuously grow in size, consuming memory and processing time.

AWS Lambda destroys and recreates the execution environment for every invocation, but the global variable is cached by the AWS Lambda service itself, requiring the developer to clear the cache via SDK.

The Lambda function is associated with a private VPC subnet without an active NAT Gateway, preventing the global scope from being re-initialized by the AWS Lambda service API.

The execution context is isolated per invocation, but the global variable undergoes memory leaks directly to the host operating system virtual machine, causing the execution to hang.

Cevabı ve açıklamayı göster

Cevap: AWS Lambda reuses the execution context for subsequent invocations, causing the global list variable to persist and continuously grow in size, consuming memory and processing time.

Cevap

AWS Lambda reuses the execution context for subsequent invocations, causing the global list variable to persist and continuously grow in size, consuming memory and processing time.

AWS Lambda optimizes performance by reusing the execution environment for subsequent invocations. Because the list is declared outside the handler, it is only initialized once (during the cold start). Warm invocations append items to the same list in memory, causing it to grow indefinitely, which leads to increased latency and timeouts.

Adım Adım Çözüm

Analyze the scope of the variable initialization.

The variable `processed_ids` is declared outside the handler function, making it global to the execution environment.

Variables declared outside the handler are initialized during the initialization phase (cold start) and remain in memory as long as the container is active.

Evaluate the behavior of AWS Lambda container reuse (warm starts).

Subsequent invocations use the same warm container to process events quickly without running the initialization code again.

Reusing the container means that the global state, including the `processed_ids` list, is preserved between executions.

Identify the cause of the performance degradation.

As new IDs are appended to the global list on every invocation, the list grows larger, leading to higher memory consumption and slower processing times.

Since the list is never cleared and keeps growing, the function eventually runs out of memory or times out.

Anahtar Kavram

AWS Lambda execution context reuse and its impact on global state management.

Tahmini Süre:45s

Soru 86Soru →

A developer has enabled active tracing on an AWS Lambda function that processes incoming requests and writes data to an Amazon DynamoDB table. When viewing the traces in AWS X-Ray, the developer can see the Lambda function segment, but the downstream calls to DynamoDB are missing from the trace map. Which action should the developer take to resolve this issue?

Instrument the AWS SDK client in the Lambda function code using the AWS X-Ray SDK.

Increase the execution timeout of the Lambda function to allow more time for tracing packets to be sent to X-Ray.

Change the API Gateway integration type from Lambda Proxy integration to Lambda Custom integration.

Initialize the DynamoDB client by hardcoding AWS access keys with permissions to write to X-Ray.

Cevabı ve açıklamayı göster

Cevap: Instrument the AWS SDK client in the Lambda function code using the AWS X-Ray SDK.

Cevap

Instrument the AWS SDK client in the Lambda function code using the AWS X-Ray SDK.

To record downstream calls to AWS services, the application code must use the AWS X-Ray SDK to wrap or instrument the AWS SDK client. For example, in Node.js, this is done by wrapping the AWS SDK with AWSXRay.captureAWS(require('aws-sdk')), or using the AWS X-Ray SDK for Java or Python equivalent. This ensures that the tracing context is propagated and downstream subsegments are created.

Adım Adım Çözüm

Identify the missing segment in the X-Ray trace map.

The Lambda execution segment is present, but downstream calls to DynamoDB are not captured.

This indicates that active tracing is configured on the Lambda function itself, but the downstream SDK calls are not propagating the trace context.

Modify the application code to wrap the AWS SDK client with the AWS X-Ray SDK.

The SDK calls are instrumented, and tracing headers are automatically generated and sent to the X-Ray daemon.

The X-Ray SDK wraps AWS SDK clients to measure downstream calls and append segment data.

Anahtar Kavram

AWS X-Ray SDK instrumentation for downstream AWS SDK calls

Soru 87Soru →

A developer has a serverless application consisting of Amazon API Gateway, an AWS Lambda function, and an Amazon DynamoDB table. The developer enables active tracing on both the API Gateway stage and the Lambda function. However, when inspecting the AWS X-Ray service map, the developer notices that downstream DynamoDB service calls are missing from the trace path. Which of the following actions is required to ensure that DynamoDB calls are included in the distributed trace?

Instrument the AWS SDK client inside the Lambda function code using the AWS X-Ray SDK to capture downstream calls.

Rely solely on the active tracing setting in the Lambda function configuration, as this automatically instruments all downstream AWS SDK clients.

Hardcode an IAM user access key and secret key with AWS X-Ray write permissions directly in the Lambda function initialization code.

Increase the Amazon SQS visibility timeout of the downstream queue to allow the X-Ray daemon more time to buffer trace segments.

Cevabı ve açıklamayı göster

Cevap: Instrument the AWS SDK client inside the Lambda function code using the AWS X-Ray SDK to capture downstream calls.

Cevap

Instrument the AWS SDK client inside the Lambda function code using the AWS X-Ray SDK to capture downstream calls.

The correct answer is to instrument the AWS SDK client inside the Lambda function code using the AWS X-Ray SDK. Enabling active tracing on Lambda only enables tracing of the function invocation itself. To trace downstream calls to other AWS resources, the AWS SDK client must be explicitly instrumented using the AWS X-Ray SDK so that the trace context is passed and recorded.

Adım Adım Çözüm

Identify the missing segment in the distributed trace.

The AWS X-Ray service map shows the API Gateway and Lambda function, but not the calls made from the Lambda function to DynamoDB.

Although active tracing is enabled on the Lambda function, the Lambda runtime only records the inbound request unless the client libraries are instrumented to propagate the tracing header.

Add the AWS X-Ray SDK to the project dependencies and instrument the AWS SDK client.

The AWS SDK client is wrapped or instrumented (e.g., using the AWS X-Ray SDK's capture helper) before initializing the DynamoDB client.

This wrapping automatically records downstream metadata, latency, and HTTP status code details for each DynamoDB call and associates them with the parent tracing segment.

Deploy the Lambda function and test the API integration.

The updated traces now include the DynamoDB node on the service map and the corresponding subsegments in the trace details.

The instrumented SDK automatically extracts the tracing header from the Lambda environment and passes it along to the DynamoDB endpoint.

Anahtar Kavram

Instrumenting AWS SDK clients in code is required to trace downstream service calls in AWS X-Ray.

Soru 88Soru →

A developer is troubleshooting a Node.js AWS Lambda function that processes events from an Amazon DynamoDB stream. The function is configured to run inside two private subnets of a custom VPC to write caching updates to an Amazon ElastiCache for Redis cluster in the same subnets. The function also makes HTTPS calls to an external third-party service to validate customer addresses. The developer observes two symptoms in Amazon CloudWatch Logs: first, the function fails to connect to the external address validation API, resulting in connection timeout errors; second, even when address validation succeeds, the function execution duration frequently runs close to the maximum configured timeout of $30$ seconds because the database connections in the connection pool remain active, preventing the Node.js event loop from exiting. Which two actions should the developer take to resolve these issues? (Select two.)

Geçerli olan tümünü seçin

Deploy a NAT Gateway in a public subnet of the VPC, and add a route in the route tables of the Lambda function's private subnets that targets the NAT Gateway for destination

0.0.0.0/0

Set the context.callbackWaitsForEmptyEventLoop property to false in the Lambda handler code.

Enable the public IP address setting in the Lambda function's VPC configuration and move the function ENIs to a public subnet.

Configure an Internet Gateway in the VPC, and update the route tables of the Lambda function's private subnets to route

0.0.0.0/0

directly to the Internet Gateway.

Increase the Lambda function's timeout configuration to

15

minutes and implement a background process to force close connections after

25

seconds.

Cevabı ve açıklamayı göster

Cevap: Deploy a NAT Gateway in a public subnet of the VPC, and add a route in the route tables of the Lambda function's private subnets that targets the NAT Gateway for destination $0.0.0.0/0$ .; Set the context.callbackWaitsForEmptyEventLoop property to false in the Lambda handler code.

Cevap

Deploy a NAT Gateway in a public subnet of the VPC and route outbound traffic from the private subnets to it. Additionally, set context.callbackWaitsForEmptyEventLoop to false in the handler code.

To resolve the API connection timeout, the Lambda function requires internet access. Since it is located in private subnets, it cannot route traffic directly to an Internet Gateway or utilize public IPs. Instead, a NAT Gateway must be set up in a public subnet, and the route tables for the private subnets must direct outbound traffic to it. To resolve the event loop timeout, the callbackWaitsForEmptyEventLoop property on the context object must be set to false. This tells the Lambda runtime to return the response immediately after the callback is invoked, frozen in state, without waiting for the connection pool to empty.

Adım Adım Çözüm

Diagnose the external API connection timeout issue.

Determine that the Lambda function is running in private subnets without outbound route access to the public internet.

VPC-associated Lambda functions in private subnets require a NAT Gateway or VPC endpoint to connect to public endpoints.

Resolve the network connectivity problem.

Create a NAT Gateway in a public subnet and add a route mapping

0.0.0.0/0

to the NAT Gateway in the private subnets' route tables.

This establishes a valid route for outbound internet traffic from the private subnets.

Diagnose the function timeout issue caused by open connections.

Identify that the Node.js event loop is waiting for the active database connection pool to ElastiCache to be empty before terminating the invocation.

The default behavior of Node.js in Lambda keeps the execution active until the event loop is empty.

Resolve the event loop delay in the handler code.

Configure context.callbackWaitsForEmptyEventLoop to false at the beginning of the handler function.

This instructs Lambda to return the callback response immediately, bypassing the empty event loop check.

Anahtar Kavram

Debugging Lambda execution context behavior and VPC routing configurations

Soru 89Soru →

A reporting service executes an AWS Lambda function residing in private VPC subnets to generate PDF documents. The function must fetch raw data from an Amazon S3 bucket, compile the PDF, and then register the document ID by making an HTTPS request to an external registry API. Under the current configuration, the Lambda function consistently fails to connect to both Amazon S3 and the external registry API, resulting in connection timeout errors.

Which two network modifications should the developer implement to enable successful execution? (Select TWO.)

Geçerli olan tümünü seçin

Create a Gateway VPC Endpoint for Amazon S3 in the VPC and associate it with the route tables of the Lambda function's subnets.

Provision a NAT Gateway in a public subnet, and add a route in the private subnet route tables that directs Internet-bound traffic (0.0.0.0/0) to the NAT Gateway.

Configure an Internet Gateway in the VPC, and add a route directing 0.0.0.0/0 to the Internet Gateway in the Lambda function's private subnet route tables.

Configure the Lambda function's VPC settings to assign a public IPv4 address to the function's elastic network interfaces (ENIs) automatically.

Increase the execution timeout value of the Lambda function to 15 minutes to allow enough time for TCP connection retries to complete.

Cevabı ve açıklamayı göster

Cevap: Create a Gateway VPC Endpoint for Amazon S3 in the VPC and associate it with the route tables of the Lambda function's subnets.; Provision a NAT Gateway in a public subnet, and add a route in the private subnet route tables that directs Internet-bound traffic (0.0.0.0/0) to the NAT Gateway.

Cevap

Create a Gateway VPC Endpoint for Amazon S3 in the VPC and associate it with the route tables of the Lambda function's subnets, and provision a NAT Gateway in a public subnet, and add a route in the private subnet route tables that directs Internet-bound traffic to the NAT Gateway.

To allow a Lambda function running inside private VPC subnets to reach public resources, proper routing must be configured. For Amazon S3, configuring a Gateway VPC Endpoint enables the function to access S3 privately through the AWS network. For the external HTTP registry API, the function's traffic must be routed via a NAT Gateway located in a public subnet, which translates the private IP addresses of the Lambda ENIs to a public IP to enable internet access.

Adım Adım Çözüm

Analyze the destination of the outbound traffic.

The Lambda function needs to connect to Amazon S3 (a public AWS service) and an external third-party registry API over the internet.

Identifying the distinct destinations allows for mapping the required VPC routing configurations.

Configure routing for Amazon S3.

A Gateway VPC Endpoint for S3 is configured, and route tables are updated to direct S3 traffic (via prefix lists) through the endpoint.

This establishes a private, cost-effective route to Amazon S3 without requiring internet access.

Configure routing for the external HTTPS API.

A NAT Gateway is deployed in a public subnet, and the private subnet route tables are updated to point default traffic (0.0.0.0/0) to the NAT Gateway.

Because Lambda ENIs only have private IP addresses, they require a NAT Gateway to perform network address translation and reach external endpoints.

Anahtar Kavram

VPC routing requirements for AWS Lambda functions executing in private subnets needing S3 and public internet access

Tahmini Süre:2m 0s

Soru 90Soru →

An e-commerce application uses Amazon API Gateway to trigger an AWS Lambda function that processes checkout requests. Although API Gateway and Lambda have active tracing enabled, the downstream calls made by the Lambda function using the AWS SDK for Python (Boto3) to an Amazon DynamoDB table are missing from the trace map in AWS X-Ray. What should the developer do to ensure downstream DynamoDB calls are included in the trace?

Increase the Lambda function timeout to ensure the background X-Ray daemon has enough time to transmit the DynamoDB segment before the container stops.

Change the API Gateway integration type to Lambda Custom Integration and configure a mapping template to extract the trace ID header.

Import the `patch_all` function from the `aws_xray_sdk.core` package and call it during the function's initialization to automatically instrument the AWS SDK client.

Manually inject the `X-Amzn-Trace-Id` header into the DynamoDB client request parameters for every put item operation.

Cevabı ve açıklamayı göster

Cevap: Import the `patch_all` function from the `aws_xray_sdk.core` package and call it during the function's initialization to automatically instrument the AWS SDK client.

Cevap

Import the `patch_all` function from the `aws_xray_sdk.core` package and call it during the function's initialization to automatically instrument the AWS SDK client.

Calling `patch_all` from the AWS X-Ray SDK for Python automatically instruments supported libraries, including Boto3. This enables the X-Ray SDK to intercept downstream DynamoDB API calls, create subsegments, and automatically propagate the tracing context without manual header manipulation.

Adım Adım Çözüm

Analyze the missing component of the trace map.

The Lambda function is successfully traced, but calls to DynamoDB using the Boto3 library do not generate downstream segments, indicating a client-side instrumentation issue.

By default, enabling active tracing on Lambda only traces the Lambda service and function execution, not the library calls within the code.

Select the correct instrumentation method for Python's Boto3 SDK.

Identify that the AWS X-Ray SDK for Python provides patch functions (such as `patch_all` or `patch`) to intercept calls made by Boto3.

Patching Boto3 is the standard way to hook into the client request lifecycle and automatically generate subsegments for downstream AWS services.

Implement the patch function at the initialization phase.

Place the `patch_all()` call at the top of the Lambda function file, before Boto3 clients are instantiated.

Calling `patch_all()` before creating clients ensures all subsequent clients are properly wrapped and instrumented for distributed tracing.

Anahtar Kavram

AWS SDK client instrumentation in Python using the AWS X-Ray SDK is required to capture and trace downstream AWS service calls.

Soru 91Soru →

A developer is deploying a backend compliance service using an AWS Lambda function. The function is configured to connect to an Amazon Aurora PostgreSQL database in a private subnet, and it also calls a third-party compliance verification HTTPS endpoint on the internet.

The Lambda function is configured with:
- Execution timeout: $30\text{ seconds}$
- Memory: $512\text{ MB}$
- VPC configuration: Attached to Subnet A and Subnet B
- Security Group: Outbound allows all traffic (`0.0.0.0/0`); Inbound is restricted.

Subnet A's route table has a route for `0.0.0.0/0` pointing to a NAT Gateway located in a public subnet. However, Subnet B's route table has a route for `0.0.0.0/0` pointing directly to an Internet Gateway.

During testing under high concurrency, the developer observes two issues in Amazon CloudWatch Logs:
1. The Lambda function intermittently fails with a timeout error after $30\text{ seconds}$ during peak traffic. The database client connection pool is initialized outside the Lambda handler function.
2. The function fails to connect to the third-party compliance verification endpoint, throwing a network connection timeout, but only during execution threads that run in Subnet B.

Which two actions should the developer take to resolve these execution and configuration issues?

Geçerli olan tümünü seçin

Associate Subnet B with a route table that routes outbound traffic (`0.0.0.0/0`) to the NAT Gateway instead of the Internet Gateway.

Deploy an Amazon RDS Proxy between the Lambda function and the Aurora PostgreSQL database, and update the function to connect to the proxy endpoint.

Enable public IP address assignment in the Lambda function's VPC configuration settings.

Move the database client connection pool initialization inside the Lambda handler function so that a new database connection is created and closed on every invocation.

Configure an inbound security group rule for the Lambda function that allows traffic from the NAT Gateway on port

443

Cevabı ve açıklamayı göster

Cevap: Associate Subnet B with a route table that routes outbound traffic (`0.0.0.0/0`) to the NAT Gateway instead of the Internet Gateway.; Deploy an Amazon RDS Proxy between the Lambda function and the Aurora PostgreSQL database, and update the function to connect to the proxy endpoint.

Cevap

Associate Subnet B with a route table that routes outbound traffic to the NAT Gateway instead of the Internet Gateway, and deploy an Amazon RDS Proxy between the Lambda function and the Aurora PostgreSQL database.

To resolve the internet connectivity issue in Subnet B, the subnet must route internet-bound traffic through the NAT Gateway. Lambda functions running in a VPC do not get public IPs and cannot communicate with the internet directly via an Internet Gateway. To resolve the database connection exhaustion under concurrent load, an Amazon RDS Proxy should be deployed. The proxy handles database connection pooling and efficiently shares connections across Lambda execution environments, preventing connection limits from being breached and avoiding function execution timeouts.

Adım Adım Çözüm

Analyze the network connection timeout to the external HTTPS endpoint occurring only in Subnet B.

Subnet B routes outbound traffic directly to an Internet Gateway. However, Lambda functions in a VPC do not receive public IP addresses, meaning they cannot route traffic directly through an Internet Gateway.

This explains why executions in Subnet B fail to reach the internet, while Subnet A executions succeed via the NAT Gateway.

Determine the required VPC networking correction for Subnet B.

Change the routing of Subnet B so that its route table directs outbound traffic (`0.0.0.0/0`) to the NAT Gateway rather than the Internet Gateway.

This routes Subnet B's internet traffic through the NAT Gateway, which performs NAT translation using its public IP address.

Analyze the database connection and execution timeouts under high concurrency.

When Lambda scales out concurrently, each container creates its own connection pool. These multiple pools quickly exceed the maximum connection limit of the Aurora PostgreSQL database, causing subsequent Lambda executions to block indefinitely and time out.

This explains why initializing the pool outside the handler does not prevent database-side connection exhaustion at scale.

Determine the proper connection management solution.

Deploy an Amazon RDS Proxy between the Lambda function and the database.

RDS Proxy pools database connections and shares them across multiple Lambda execution environments, preventing connection exhaustion and reducing execution timeout issues.

Anahtar Kavram

VPC networking routing rules for AWS Lambda and database connection management at scale.

Soru 92Soru →

A developer has deployed a microservice as an Amazon ECS task. The application writes JSON-formatted logs to an Amazon CloudWatch Logs group named `/aws/ecs/payment-service`. A sample log event is shown below:

{
"level": "error",
"responseCode": 504,
"latency": 1500,
"context": {
"api": "charge"
}
}

The developer needs to:
1. Create a CloudWatch metric filter to increment a custom metric named `PaymentTimeoutCount` whenever `responseCode` is $504$ and `latency` is greater than $1000$ . Currently, the developer's metric filter pattern `[level = "error", responseCode = 504, latency > 1000]` is matching zero events.
2. Stream these matching log events in real time to an Amazon Kinesis Data Firehose delivery stream for archiving in Amazon S3. The developer has created a CloudWatch subscription filter pointing to Kinesis Data Firehose, but logs are not arriving in the S3 bucket, and CloudWatch Logs reports delivery errors.

Which two actions must the developer perform to resolve these issues? (Select two.)

Geçerli olan tümünü seçin

Update the metric filter pattern to use JSON object syntax: `{

.responseCode = 504 &&

.latency > 1000 }`.

Change the metric filter pattern to use a SQL-like query structure: `SELECT * WHERE responseCode = 504 AND latency > 1000`.

Update the IAM role associated with the subscription filter to trust the `logs.amazonaws.com` service principal to perform the `sts:AssumeRole` action.

Modify the Kinesis Data Firehose delivery stream's IAM role to grant the `logs:PutSubscriptionFilter` permission to the CloudWatch Logs service.

Update the ECS task execution role to permit the `firehose:PutRecord` action on the destination delivery stream.

Cevabı ve açıklamayı göster

Cevap: Update the metric filter pattern to use JSON object syntax: `{ $.responseCode = 504 &&$ .latency > 1000 }`.; Update the IAM role associated with the subscription filter to trust the `logs.amazonaws.com` service principal to perform the `sts:AssumeRole` action.

Cevap

To resolve the issues, the developer must update the metric filter pattern to use the JSON object syntax `{

.responseCode = 504 &&

.latency > 1000 }` and update the subscription filter's IAM role trust policy to trust the `logs.amazonaws.com` service principal to perform the `sts:AssumeRole` action.

For JSON-structured logs in CloudWatch Logs, metric filter patterns must follow the JSON object syntax enclosed in curly braces with the `

.` path prefix for fields. The correct pattern is `{

.responseCode = 504 && $.latency > 1000 }`. Additionally, to write logs to Kinesis Data Firehose via a subscription filter, CloudWatch Logs must assume an IAM role. The role's trust policy must allow `logs.amazonaws.com` to assume the role, and the policy must permit `firehose:PutRecord` operations on the target delivery stream.

Adım Adım Çözüm

Diagnose the metric filter matching failure.

The metric filter is currently using space-delimited syntax (`[...]`), which expects space-separated values. Since the logs are JSON-formatted, CloudWatch Logs does not match the fields properly, resulting in zero matched events.

Structured JSON log groups require JSON path query notation to query inner fields.

Correct the metric filter pattern.

Convert the pattern to `{

.responseCode = 504 &&

.latency > 1000 }`.

This JSON syntax properly addresses the target fields and logical operators in CloudWatch Logs metric filters.

Diagnose the subscription filter delivery issue.

Determine that CloudWatch Logs requires permission to write to Kinesis Data Firehose via an IAM role. The delivery error indicates CloudWatch Logs cannot assume the configured role.

Subscription filters execute asynchronously at the CloudWatch service level, necessitating a trust relationship with the `logs.amazonaws.com` service principal.

Update the IAM role trust policy.

Add `logs.amazonaws.com` under the `Principal` block with the `sts:AssumeRole` action.

This authorizes CloudWatch Logs to temporarily assume the role and execute `firehose:PutRecord` batch calls to the delivery stream.

Anahtar Kavram

CloudWatch Logs Metric Filters JSON syntax and Subscription Filter IAM permissions

Tahmini Süre:3m 0s

Soru 93Soru →

A developer is deploying a Node.js application to Amazon ECS using the AWS Fargate launch type. The application calls downstream AWS services using the AWS SDK. The developer needs to configure distributed tracing with AWS X-Ray for this containerized application. Which two actions must the developer take to instrument the application and enable trace data collection? (Select TWO.)

Geçerli olan tümünü seçin

Instrument the application code by wrapping the AWS SDK client with the AWS X-Ray SDK.

Add the AWS X-Ray daemon container as a sidecar container in the Amazon ECS task definition.

Initialize the AWS SDK clients by hardcoding AWS access keys and secret keys inside the Node.js application configuration files.

Configure custom API Gateway mapping templates to extract the X-Ray trace headers and pass them as environment variables to the container.

Modify the Amazon SQS queue visibility timeout to be lower than the X-Ray segment propagation timeout to prevent loss of tracing segments.

Cevabı ve açıklamayı göster

Cevap: Instrument the application code by wrapping the AWS SDK client with the AWS X-Ray SDK.; Add the AWS X-Ray daemon container as a sidecar container in the Amazon ECS task definition.

Cevap

Instrumenting the application code by wrapping the AWS SDK client with the AWS X-Ray SDK, and adding the AWS X-Ray daemon container as a sidecar container in the Amazon ECS task definition are both required.

To enable distributed tracing for a Node.js application running on ECS Fargate, two main configurations are necessary: first, instrumenting the application code by wrapping the AWS SDK client to generate segment data, and second, configuring the X-Ray daemon as a sidecar container in the task definition to receive and forward these traces.

Adım Adım Çözüm

Wrap the AWS SDK client with the AWS X-Ray SDK inside the Node.js application code.

The application code is instrumented to capture downstream AWS calls as trace segments.

Without code instrumentation, the AWS SDK will not generate trace data for outbound service calls.

Define an AWS X-Ray daemon container in the task definition to run as a sidecar alongside the application container.

A local X-Ray daemon is running and listening on UDP port 2000 within the same ECS task.

The X-Ray SDK sends trace data to the local daemon, which buffers and uploads the traces to the AWS X-Ray service.

Anahtar Kavram

Instrumenting distributed tracing for containerized applications on ECS requires both application-level code instrumentation using the AWS X-Ray SDK and deploying the X-Ray daemon as a sidecar container.

Soru 94Soru →

A developer is troubleshooting a containerized Node.js application deployed on Amazon ECS with AWS Fargate. The application calls an external third-party API for address validation and writes records to an Amazon DynamoDB table. The developer configured the AWS X-Ray daemon as a sidecar container in the ECS task definition. While DynamoDB tracing is working correctly, the external API calls do not appear on the X-Ray service map, and trace context is lost for downstream transactions.

Which two actions should the developer take to resolve these issues and ensure complete distributed tracing? (Select TWO.)

Geçerli olan tümünü seçin

Use the AWS X-Ray SDK Express middleware to capture incoming HTTP requests and establish the parent segment context.

Use the AWS X-Ray SDK to wrap the Node.js HTTP/HTTPS module using captureHTTPsGlobal to instrument downstream HTTP calls.

Add the AWSXRayDaemonWriteAccess policy to the ECS Task Execution Role to permit trace data transmission.

Initialize the AWS SDK client inside the application by hardcoding temporary IAM access keys obtained from the container metadata service.

Configure the SQS visibility timeout of any downstream queue to be longer than the API Gateway integration timeout to prevent trace segments from splitting.

Cevabı ve açıklamayı göster

Cevap: Use the AWS X-Ray SDK Express middleware to capture incoming HTTP requests and establish the parent segment context.; Use the AWS X-Ray SDK to wrap the Node.js HTTP/HTTPS module using captureHTTPsGlobal to instrument downstream HTTP calls.

Cevap

To enable complete distributed tracing, the developer must use the AWS X-Ray SDK Express middleware to capture incoming HTTP requests and establish the parent segment context, and use the AWS X-Ray SDK to wrap the Node.js HTTP/HTTPS module using captureHTTPsGlobal to instrument downstream HTTP calls.

Establishing incoming request context via Express middleware and wrapping outgoing HTTP client libraries with the AWS X-Ray SDK ensure that trace IDs are generated, propagated, and associated correctly. This enables the complete trace path to appear on the X-Ray service map.

Adım Adım Çözüm

Add the AWS X-Ray SDK Express middleware to the Node.js application.

Incoming HTTP requests are intercepted, a parent segment is initialized, and the tracing context is set.

Without parent segment context initialized for incoming requests, any downstream subsegments created during external calls will fail to associate correctly.

Wrap the HTTP/HTTPS core modules using the AWS X-Ray SDK's captureHTTPsGlobal method.

Outgoing HTTP requests to the third-party API are instrumented, creating subsegments and appending the tracing header.

Unwrapped HTTP client calls are not intercepted by the SDK, preventing trace details from being sent to X-Ray and losing trace correlation.

Anahtar Kavram

Instrumenting distributed tracing for containerized applications involves initializing incoming request middleware to manage trace context and wrapping downstream HTTP clients to propagate the tracing header.

Soru 95Soru →

A developer is deploying a backend worker microservice as an AWS Lambda function. The function is designed to poll an Amazon SQS queue, process incoming JSON messages, and write results to an Amazon DynamoDB table. The developer creates an IAM role named BackendWorkerRole and attaches the managed policies AWSLambdaSQSQueueExecutionRole and AmazonDynamoDBFullAccess to it. However, when trying to associate BackendWorkerRole as the execution role in the Lambda function's configuration using the AWS CLI, the command fails with the following error:

An error occurred (InvalidParameterValueException) when calling the CreateFunction operation: The role defined for the function cannot be assumed by Lambda.

Which of the following configuration adjustments is required to resolve this error?

Add an inline permission policy to the role that explicitly grants the sts:AssumeRole action on the AWS Lambda service principal.

Modify the trust policy of the role to specify 'lambda.amazonaws.com' as the trusted service principal allowed to assume the role.

Update the Lambda function's initialization code to explicitly call the AWS STS AssumeRole API using hardcoded temporary access keys.

Increase the Lambda function's execution timeout limit to 15 minutes to ensure that the STS session credentials do not expire during function creation.

Cevabı ve açıklamayı göster

Cevap: Modify the trust policy of the role to specify 'lambda.amazonaws.com' as the trusted service principal allowed to assume the role.

Cevap

Modify the trust policy of the role to specify 'lambda.amazonaws.com' as the trusted service principal allowed to assume the role.

The correct answer is correct because AWS Lambda requires a trust policy (trust relationship) defined on the execution role. This policy must explicitly trust the 'lambda.amazonaws.com' service principal and allow it to perform the 'sts:AssumeRole' action. Without this trust configuration, AWS Lambda cannot assume the execution role to retrieve the credentials needed to access downstream resources.

Adım Adım Çözüm

Analyze the error message returned by the AWS CLI execution.

The error indicates that Lambda is blocked from assuming the defined execution role.

The AWS Lambda service principal must have trust relationship permissions to assume the role on the user's behalf.

Review the trust policy of the BackendWorkerRole IAM role.

Identify that the trust policy is missing the service principal lambda.amazonaws.com or restricts it incorrectly.

Trust policies govern which entities can assume the role, whereas permission policies govern what the role can access.

Update the IAM role's trust relationship document to allow lambda.amazonaws.com.

The Lambda service can now successfully assume the role using AWS STS, and the function configuration succeeds.

This updates the trust configuration necessary for AWS Lambda to execute in your account environment.

Anahtar Kavram

IAM Execution Role Trust Policies for AWS Lambda

Soru 96Soru →

A developer is troubleshooting a Python-based AWS Lambda function that processes real-time telemetry packets from an Amazon Kinesis Data Stream. The function is configured with a memory limit of $128\text{ MB}$ and a timeout of $3\text{ seconds}$ . It is attached to a private subnet within a VPC to query an Amazon RDS database. During testing, the developer observes the following issues:
- The Lambda function logs `Task timed out after 3.00 seconds` when processing batches with larger telemetry packets.
- The Lambda function fails with a socket timeout error when trying to send analytical summaries to an external third-party API.

Which two actions should the developer take to resolve these issues? (Select two.)

Geçerli olan tümünü seçin

Configure a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table pointing

0.0.0.0/0

traffic to the NAT Gateway.

Increase the Lambda function's timeout configuration to allow more processing time and allocate more memory to scale CPU performance proportionally.

Associate the Lambda function with a public subnet and enable the public IP assignment configuration on the function's elastic network interface (ENI).

Add a route in the private subnet's route table that maps all internet-bound traffic (

0.0.0.0/0

) directly to an Internet Gateway.

Modify the Lambda function's initialization code to force the destruction of the execution context at the end of every handler invocation.

Cevabı ve açıklamayı göster

Cevap: Configure a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table pointing $0.0.0.0/0$ traffic to the NAT Gateway.; Increase the Lambda function's timeout configuration to allow more processing time and allocate more memory to scale CPU performance proportionally.

Cevap

To resolve these issues, the developer must configure a NAT Gateway in a public subnet and update the private subnet's route table to route internet-bound traffic to it, and also increase the Lambda function's timeout and memory configuration.

To resolve the external API connection issue, the Lambda function must have outbound internet access. Since the function is in a private subnet, a NAT Gateway must be created in a public subnet, and the private subnet's route table must route all outbound traffic (

0.0.0.0/0

) to this NAT Gateway. To resolve the timeout issues, the function's execution time must be extended by increasing the timeout configuration, and allocating more memory will scale the CPU performance proportionally, allowing it to process large telemetry packets faster.

Adım Adım Çözüm

Diagnose the database and external API connectivity failure.

The Lambda function is associated with a private subnet to securely query the Amazon RDS database, which blocks direct access to the public internet.

A Lambda function configured to run in a VPC does not have access to the public internet by default, resulting in socket timeouts when attempting to reach the external third-party API.

Configure outbound internet connectivity.

Create a NAT Gateway in a public subnet of the VPC and add a route in the private subnet's route table pointing

0.0.0.0/0

traffic to the NAT Gateway.

The NAT Gateway translates private IP traffic from the private subnet to a public IP and routes it to the Internet Gateway, enabling the Lambda function to reach the external API.

Resolve the execution timeout issue.

Increase the Lambda function's timeout setting and allocate more memory.

Larger telemetry packets require more processing time and compute power. Increasing the memory limit scales the CPU proportionally, and extending the timeout window prevents premature execution failures.

Anahtar Kavram

Configuring VPC Lambda network routing for internet access and tuning memory and timeout settings to resolve processing bottlenecks.

Tahmini Süre:2m 0s

Soru 97Soru →

An IoT telemetry ingestion application processes sensor data using an AWS Lambda function written in Node.js and writes the parsed payloads to an Amazon RDS database. During testing under heavy load, the Lambda function execution terminates prematurely after $3$ seconds, and the database metrics show a spike in active client connections that reaches the database's limit. The database connection client initialization code is currently located inside the Lambda handler function.

Which TWO actions should be taken to resolve these configuration and execution issues?

Geçerli olan tümünü seçin

Increase the Lambda function's timeout configuration to a value that accommodates the database write latency.

Move the database connection initialization code outside of the Lambda handler function to reuse the database client across multiple invocations.

Deploy the Lambda function in a public subnet of a VPC to allow direct internet access to the database.

Enable active tracing with AWS X-Ray to automatically close database connections at the end of each invocation.

Reduce the Lambda function's memory configuration to force faster garbage collection of unused database connections.

Cevabı ve açıklamayı göster

Cevap: Increase the Lambda function's timeout configuration to a value that accommodates the database write latency.; Move the database connection initialization code outside of the Lambda handler function to reuse the database client across multiple invocations.

Cevap

Increase the Lambda function's timeout configuration and move the database connection initialization code outside of the Lambda handler function.

Increasing the function timeout allows it to execute beyond the 3-second default threshold, which accommodates database write latency. Moving the database client initialization outside of the handler leverages the Lambda execution context reuse, allowing subsequent requests to share the connection pool and avoiding database connection exhaustion.

Adım Adım Çözüm

Analyze the log metrics to identify that the execution terminates early because of the default 3-second timeout limit.

Confirming that the timeout limit needs to be increased.

The function requires more time to complete database connections and writes.

Analyze the database connection limit error to identify that new connections are created for every single invocation.

Confirming that the database client is initialized inside the handler.

Initializing the client inside the handler forces a new connection on every invocation, causing connection pool exhaustion.

Modify the code to move the initialization of the database client outside the handler and update the Lambda timeout configuration in the AWS console or IaC template.

Connection reuse is enabled across warm starts, and execution times are allowed to exceed 3 seconds.

This resolves both the timeout and connection exhaustion issues by optimizing execution context reuse and configuration parameters.

Anahtar Kavram

AWS Lambda configuration tuning and execution context optimization

Soru 98Soru →

A developer has configured an AWS Lambda function inside a private subnet of a VPC to connect to an internal database. The function also needs to call an external API on the public internet, but all connection attempts to the external API time out. Which configuration change will resolve this issue while maintaining access to the private database?

Route the outbound traffic from the private subnet containing the Lambda function through a NAT Gateway.

Move the Lambda function to a public subnet within the VPC to allow direct internet access.

Configure the Lambda function to assign a public IP address to its Elastic Network Interface (ENI).

Increase the Lambda function's execution timeout limit to allow the connection to succeed.

Cevabı ve açıklamayı göster

Cevap: Route the outbound traffic from the private subnet containing the Lambda function through a NAT Gateway.

Cevap

Route the outbound traffic from the private subnet containing the Lambda function through a NAT Gateway.

For a Lambda function inside a VPC to access the internet, it must be placed in a private subnet. The outbound traffic from this private subnet must be routed to a NAT Gateway located in a public subnet, which then routes the traffic to the internet through an Internet Gateway.

Adım Adım Çözüm

Identify the networking requirements of the Lambda function.

The Lambda function needs to communicate with an internal database inside the VPC and an external API on the public internet.

Placing a Lambda function inside a VPC restricts its default direct internet access.

Determine the proper routing configuration for internet access from a VPC.

Lambda functions in a VPC require a NAT Gateway (or NAT instance) to translate private subnet traffic to the public internet.

Lambda functions do not get public IP addresses assigned to their network interfaces, meaning they cannot use an Internet Gateway directly.

Configure the subnet route tables.

Add a route to the private subnet's route table pointing 0.0.0.0/0 traffic to the NAT Gateway in the public subnet.

This establishes a valid outbound path to the internet for resources inside the private subnet.

Anahtar Kavram

VPC Lambda Internet Connectivity

Soru 99Soru →

A developer is running a Python daemon application on an Amazon EC2 instance. The application processes tasks by retrieving messages from an Amazon SQS queue and making downstream API calls to an external gateway using the `requests` library. The AWS X-Ray daemon is running on the EC2 instance, and the EC2 instance profile has the `AWSXRayDaemonWriteAccess` policy attached. The application code imports `patch_all` from the AWS X-Ray SDK and calls it at startup. However, when the application runs, the external API calls do not appear in the X-Ray console, and the logs display `SegmentNotFoundException` errors.

What is the root cause of this issue?

The hosting environment on Amazon EC2 does not automatically initialize a trace segment. The developer must manually start and end a segment in the code using the X-Ray SDK.

The `patch_all()` function only instruments AWS SDK clients. The developer must manually extract the trace header from the SQS message and inject it into the HTTP headers of the `requests` library call.

The X-Ray SDK does not support the EC2 instance profile for authentication. The developer must explicitly initialize the X-Ray recorder with hardcoded AWS access keys.

The SQS visibility timeout is shorter than the time taken to call the external API, which causes the message to reappear on the queue and invalidates the active trace segment.

Cevabı ve açıklamayı göster

Cevap: The hosting environment on Amazon EC2 does not automatically initialize a trace segment. The developer must manually start and end a segment in the code using the X-Ray SDK.

Cevap

The hosting environment on Amazon EC2 does not automatically initialize a trace segment. The developer must manually start and end a segment in the code using the X-Ray SDK.

Unlike AWS Lambda, which automatically initializes a parent segment for every invocation, self-hosted environments such as Amazon EC2 do not automatically manage trace context. When a patched HTTP library like `requests` tries to trace an outbound call, it attempts to generate a subsegment. Because there is no active segment initialized in the thread context, the SDK throws a `SegmentNotFoundException`. To resolve this, the developer must explicitly start a segment (e.g., using `xray_recorder.begin_segment()`) and end it after processing is completed.

Adım Adım Çözüm

Analyze the error log containing `SegmentNotFoundException`.

Identify that the X-Ray SDK is attempting to create a subsegment for the downstream HTTP request but cannot find an active parent segment in the current execution context.

Patched libraries automatically attempt to create subsegments, which require a parent segment to exist.

Compare the runtime environment (Amazon EC2) behavior with AWS Lambda.

Acknowledge that AWS Lambda automatically manages the lifecycle of the trace segment (facade segment), whereas EC2 does not provide any automatic segment management for custom daemon applications.

This determines whether the framework/infrastructure or the code itself must manage the lifecycle of trace segments.

Determine the necessary code modification to establish the context.

Wrap the worker loop execution or downstream calls in a manually created segment using `xray_recorder.begin_segment('segment_name')` and `xray_recorder.end_segment()` or the corresponding context manager.

Explicitly declaring a segment provides the parent context required by the patched `requests` library.

Anahtar Kavram

X-Ray Segment Lifecycle Management on Non-Managed Environments

Tahmini Süre:2m 0s

Soru 100Soru →

A developer has enabled active tracing on an AWS Lambda function that is triggered by an Amazon SQS queue. The Lambda function processes the messages and writes the results to an Amazon DynamoDB table. While reviewing the trace map in the AWS X-Ray console, the developer observes that the Lambda function execution is traced, but the downstream calls to DynamoDB do not appear in the traces. Which of the following actions should the developer take to resolve this issue?

Instrument the AWS SDK client in the Lambda function code using the AWS X-Ray SDK.

Initialize the AWS SDK client by hardcoding the AWS access key and secret access key in the function code.

Increase the Lambda function execution timeout to match the visibility timeout of the Amazon SQS queue.

Change the API Gateway integration type to use Lambda Proxy integration.

Cevabı ve açıklamayı göster

Cevap: Instrument the AWS SDK client in the Lambda function code using the AWS X-Ray SDK.

Cevap

Instrument the AWS SDK client in the Lambda function code using the AWS X-Ray SDK.

The correct answer is to instrument the AWS SDK client using the AWS X-Ray SDK. Enabling active tracing on Lambda only configures the Lambda service to trace the function execution. To trace downstream HTTP/HTTPS calls to services like DynamoDB, the AWS SDK client within the function code must be wrapped or patched by the AWS X-Ray SDK.

Adım Adım Çözüm

Identify the cause of the missing downstream service call subsegments in the AWS X-Ray trace map.

The Lambda service itself generates the main segment, but downstream calls (like DynamoDB) require the AWS SDK to be instrumented to record subsegments.

By default, the standard AWS SDK does not automatically send trace data to X-Ray unless instrumented.

Use the AWS X-Ray SDK to wrap or patch the AWS SDK client inside the Lambda function code.

Downstream calls made via the instrumented SDK client will now generate and propagate trace context to DynamoDB.

This is necessary to capture trace subsegments for outbound calls.

Anahtar Kavram

AWS SDK Instrumentation for AWS X-Ray

ÖncekiSayfa 5 / 14Sonraki

Troubleshooting and Optimization

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram