A media company is migrating its legacy content metadata ingestion system to a serverless architecture on AWS. The system must process high-volume, bursty traffic from external publishing partners, decrypt incoming metadata payloads that are encrypted in an Amazon S3 bucket, and write updates to an Amazon Aurora PostgreSQL database. The design must be highly available, run within a private subnet, connect to the database securely without exhausting connections, and prevent traffic surges from throttling other critical Lambda functions in the AWS account. The external partners run their applications in a separate AWS account and need permission to access the encrypted S3 bucket. Which architecture meets these requirements?
- Configure Amazon API Gateway with a regional endpoint that triggers an AWS Lambda function. Configure the Lambda function in the VPC across multiple Availability Zones with an Amazon RDS Proxy to handle database connections. Set reserved concurrency on the Lambda function. Encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK) and grant cross-account access in the key policy. Configure NAT Gateways in multiple Availability Zones for outbound connectivity.Cevap
- BConfigure Amazon API Gateway with a regional endpoint that triggers an AWS Lambda function. Configure the Lambda function in the VPC across multiple Availability Zones with an Amazon RDS Proxy. Leave the Lambda concurrency unconfigured to allow the function to scale automatically to its maximum limits. Encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK) and grant cross-account access in the key policy. Configure NAT Gateways in multiple Availability Zones.
- CConfigure Amazon API Gateway with a regional endpoint that triggers an AWS Lambda function. Configure the Lambda function in the VPC across multiple Availability Zones with an Amazon RDS Proxy. Set reserved concurrency on the Lambda function. Encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK) and grant cross-account access in the key policy. Configure a single NAT Gateway in a single Availability Zone to route all outbound VPC traffic to save costs.
- DConfigure Amazon API Gateway with a regional endpoint that triggers an AWS Lambda function. Configure the Lambda function in the VPC across multiple Availability Zones with an Amazon RDS Proxy. Set reserved concurrency on the Lambda function. Encrypt the S3 bucket using the default AWS-managed KMS key (aws/s3) and update its key policy to grant cross-account access. Configure NAT Gateways in multiple Availability Zones.
Cevap
Configure Amazon API Gateway with a regional endpoint, run the AWS Lambda function in the VPC across multiple Availability Zones using Amazon RDS Proxy, set a reserved concurrency limit on the Lambda function, encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK) with cross-account access granted, and deploy NAT Gateways in multiple Availability Zones.
The correct answer provides a highly available, secure, and isolated solution. Running AWS Lambda within a multi-AZ VPC subnet and utilizing Amazon RDS Proxy ensures secure database communication while preventing connection limits from being exceeded during traffic bursts. Configuring reserved concurrency isolates the ingestion workload's concurrency usage, protecting other applications in the region from being throttled. A Customer Managed Key (CMK) is required because AWS-managed keys (such as aws/s3) cannot be shared across accounts. Lastly, deploying NAT Gateways in multiple Availability Zones eliminates single points of failure for outbound routing.
Adım Adım Çözüm
Anahtar Kavram
Serverless application architecture requiring connection pooling (RDS Proxy), resource isolation (Reserved Concurrency), cross-account encryption access (KMS CMK), and network fault tolerance (multi-AZ NAT Gateways).