A maritime shipping coordinator is modernizing its vessel container tracking and dispatch … — AWS Certified Solutions Architect - Professional

A maritime shipping coordinator is modernizing its vessel container tracking and dispatch service by refactoring a legacy monolithic system into a microservices-based serverless architecture. The database has been migrated to an Amazon RDS for PostgreSQL DB instance in a private subnet. The serverless backend consists of AWS Lambda functions running in the same VPC to access the database, fronted by an Amazon API Gateway HTTP API. The system must scale up to handle sudden peaks of $12,000$ concurrent requests during port unloading operations, without exhausting database connections or affecting other services in the same AWS account. Security requirements dictate that all database credentials must be rotated automatically every $30$ days and encrypted using a Customer Managed Key (CMK) in AWS KMS.

Which TWO configurations should the solutions architect implement to meet these requirements?

Deploy an Amazon RDS Proxy in the VPC to manage database connection pooling, and configure the Lambda functions with a defined reserved concurrency limit.Cevap
Configure AWS Secrets Manager to store database credentials using a Customer Managed Key (CMK) in AWS KMS, and configure a custom rotation Lambda function to rotate the secret every $30$ days.Cevap
C
Configure the Lambda functions with Provisioned Concurrency set to $12,000$ , and leave the reserved concurrency unconfigured to allow the functions to burst freely.
D
Encrypt the database credentials in AWS Secrets Manager using the default AWS-managed KMS key (aws/secretsmanager), and associate a key policy to allow cross-account access for database rotation.
E
Configure the Lambda functions to run in a single private subnet and route all outbound database traffic through a single NAT Gateway to reduce NAT gateway hourly charges.

Cevap

Deploy an Amazon RDS Proxy in the VPC to manage database connection pooling, configure the Lambda functions with a defined reserved concurrency limit, and configure AWS Secrets Manager to store database credentials using a Customer Managed Key (CMK) in AWS KMS with a custom rotation Lambda function to rotate the secret every

30

days.

Deploying an Amazon RDS Proxy solves the database connection exhaustion issue by pooling and sharing connections. Configuring reserved concurrency limits the maximum concurrency of the container tracking Lambda functions, thereby protecting the rest of the account's unreserved pool from exhaustion. Using AWS Secrets Manager with a Customer Managed Key (CMK) allows the policy modifications required to grant necessary permissions for rotating the credentials.

Adım Adım Çözüm

Assess database connection limits and Lambda scaling behavior.

Identified that Lambda's rapid horizontal scaling up to

12,000

concurrent requests will exhaust the PostgreSQL connection limits.

Connection pooling is required to manage connections efficiently under peak serverless loads.

Address concurrency isolation across the AWS account.

Identified that unthrottled functions can consume the entire regional concurrency pool.

Configuring reserved concurrency protects the unreserved concurrency pool and prevents other workloads in the account from being starved.

Design credential management and key delegation.

Stored credentials in AWS Secrets Manager using a Customer Managed Key (CMK).

A Customer Managed Key is required to modify key policies to support cross-account access or security boundaries during automatic rotation.

Anahtar Kavram

Modernizing monolithic database-backed APIs to a serverless architecture requires managing database connection pooling (using Amazon RDS Proxy), controlling compute concurrency to prevent account-level resource starvation, and configuring secure credential rotation using AWS Secrets Manager with Customer Managed Keys.

Tahmini Süre:3m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru