A maritime shipping enterprise is modernizing its legacy vessel telemetry tracking system to a serverless architecture. The legacy system currently processes bursty ingestion traffic from global cargo ships and writes updates to an Amazon Aurora PostgreSQL DB cluster hosted in a private subnet of a central Virtual Private Cloud (VPC). The new architecture must ingest telemetry data via Amazon API Gateway and process it using AWS Lambda before writing to the database.
The solution must meet the following requirements:
- Protect the Aurora PostgreSQL database from connection exhaustion during sudden traffic spikes of up to concurrent writes.
- Ensure the Lambda functions can access the database securely and privately within the VPC without traversing the public internet.
- Allow only specific client VPCs within the company's AWS Organization to call the API Gateway privately.
- Implement a deployment strategy that gradually routes traffic to new Lambda function versions with automated rollbacks upon error detection.
Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)
- Deploy an Amazon RDS Proxy for the Aurora PostgreSQL DB cluster, configure the Lambda functions to connect to the database via the proxy, and set a reserved concurrency limit on the Lambda functions to align with the database connection pool.Cevap
- Deploy an Amazon API Gateway private API associated with interface VPC endpoints in the central VPC, apply an API Gateway resource policy that grants access only to the interface VPC endpoint IDs of the client VPCs, and use AWS CodeDeploy with AWS CloudFormation to perform a canary deployment of the Lambda functions.Cevap
- CConfigure provisioned concurrency on the Lambda functions to scale up to concurrent executions during spikes, and establish direct connections from the Lambda functions to the Aurora DB cluster to minimize latency.
- DConfigure the Lambda functions with a rolling update deployment strategy in AWS CloudFormation, and deploy a single NAT Gateway in one Availability Zone to route outbound Lambda traffic to a regional public API Gateway endpoint.
- EDeploy a regional public API Gateway endpoint, configure cross-account IAM roles to allow the client VPCs to invoke the API, and encrypt the telemetry payload using the AWS-managed KMS key `aws/lambda` in the central account.