A logistics and supply chain enterprise is modernizing its fleet dispatching and tracking application by migrating its core API to a serverless architecture on AWS. The API must handle highly bursty and unpredictable transaction volumes, spiking up to requests per second. The backend logic runs on AWS Lambda and reads from an Amazon Aurora PostgreSQL database cluster deployed in a private VPC subnet. To protect the database from connection exhaustion, an Amazon RDS Proxy has been deployed. The API Gateway endpoint is private, accessible only from the company's corporate offices through an existing AWS Direct Connect connection. The architect must ensure that:
1. Bursty traffic spikes do not exhaust the regional Lambda concurrency limit, which would throttle other critical serverless workloads in the same AWS account.
2. The database credentials, stored in AWS Secrets Manager, are rotated automatically every days and encrypted using a KMS key that can be shared with a monitoring tool in a separate security audit account.
3. The serverless compute layer remains highly available and resilient to Availability Zone failures.
Which combination of actions should the Solutions Architect implement to meet these requirements? (Select TWO.)
- Configure a reserved concurrency limit on the Lambda function to control the maximum concurrent executions, preventing the function from consuming the entire regional account concurrency pool.Cevap
- Store the database credentials in AWS Secrets Manager, enable automatic rotation, and encrypt the secret using a Customer Managed Key (CMK), configuring the KMS key policy to permit decryption by both the Lambda execution role and the cross-account security audit role.Cevap
- CConfigure provisioned concurrency on the Lambda function to handle the peak request spikes, allowing the function to scale dynamically while utilizing the default regional concurrency pool without restriction.
- DStore the database credentials in AWS Secrets Manager, enable automatic rotation, and encrypt the secret using the default AWS-managed KMS key (aws/secretsmanager), and add a cross-account permission statement to the default KMS key policy.
- EDeploy the Lambda function in a single private subnet within one Availability Zone, routing all database-bound traffic through a single NAT Gateway to simplify security group rules on the Amazon Aurora cluster.