A healthcare provider is modernizing its patient portal backend by refactoring a legacy monolithic API into a serverless architecture. The new design uses Amazon API Gateway and AWS Lambda functions that query a PostgreSQL database in a private subnet. The architecture must satisfy the following requirements:
1. The API must be accessible only from the on-premises network via an existing AWS Direct Connect connection.
2. The database must be protected from connection exhaustion during sudden morning login spikes, while ensuring Lambda functions remain highly available.
3. A single high-volume notification function must not exhaust the regional concurrency limit and disrupt other critical portal operations.
4. All application logs must be encrypted using a KMS Customer Managed Key (CMK) that is shared with a centralized security account.
Which TWO configurations should the Solutions Architect implement to meet these requirements?
- Create a Private API in Amazon API Gateway, establish an interface VPC endpoint for API Gateway in the private subnets of the VPC, and apply an API Gateway resource policy that allows access only from the VPC endpoint.Cevap
- Deploy an Amazon RDS Proxy in the private subnets of the VPC to manage database connections, and configure a reserved concurrency limit on the high-volume notification Lambda function.Cevap
- CUse the default AWS managed key (aws/logs) to encrypt the Amazon CloudWatch log groups, and modify the key policy to grant the centralized security account cross-account decryption permissions.
- DConfigure the private subnets where the Lambda functions are located to route outbound traffic through a single NAT Gateway deployed in a single public subnet to control egress costs, and rely on the default regional concurrency limit.
- EEnable provisioned concurrency on all Lambda functions to guarantee start times during peak morning spikes, and configure an Application Load Balancer to act as the entry point to route traffic directly to the private Lambda functions.