A financial services company is modernizing its on-premises core transaction processing API by refactoring it to a serverless architecture on AWS. The new architecture uses an Amazon API Gateway regional REST API integrated with AWS Lambda functions deployed in private subnets, which write transactions to an Amazon RDS for PostgreSQL database. The database is hosted in a dedicated database account, while the API Gateway and Lambda functions are hosted in an application account. During peak hours, transaction volume spikes unpredictably. The company must ensure that database connection limits are not exceeded, Lambda executions do not exhaust the regional concurrency limit, and database credentials stored in AWS Secrets Manager in the database account are automatically rotated using a cross-account IAM role.
Which architectural design meets these requirements?
- AConfigure Amazon RDS Proxy in the database account. Store the database credentials in AWS Secrets Manager in the database account, encrypted with the default AWS-managed key (aws/secretsmanager). Grant the application account's Lambda execution role permission to decrypt using this AWS-managed key, and configure the Lambda functions with a reserved concurrency limit.
- BConfigure Amazon RDS Proxy in the database account. Store the database credentials in AWS Secrets Manager in the database account, encrypted with an AWS KMS Customer Managed Key (CMK) configured with a cross-account key policy. Allow the Lambda functions to execute with unconstrained concurrency to maximize throughput, relying on API Gateway throttling and the RDS Proxy connection queue to manage database load.
- Configure Amazon RDS Proxy in the database account. Store the database credentials in AWS Secrets Manager in the database account, encrypted with an AWS KMS Customer Managed Key (CMK) configured with a cross-account key policy. Configure the Lambda functions in the application account to connect via the RDS Proxy, and set a specific reserved concurrency limit on the Lambda functions. Configure the Secrets Manager rotation Lambda to decrypt the credentials using the CMK.Cevap
- DConfigure Amazon RDS Proxy in the database account. Store the database credentials in AWS Secrets Manager in the database account, encrypted with an AWS KMS Customer Managed Key (CMK) configured with a cross-account key policy. Deploy the Lambda functions in the application VPC across multiple Availability Zones, routing all outbound internet and cross-account traffic through a single NAT Gateway located in one Availability Zone to minimize NAT Gateway hourly costs, and set a reserved concurrency limit.