Examkin

Soru

Zorluk: ZorModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A financial tech company is modernizing its transaction reconciliation system by migrating the backend database to an Amazon Aurora PostgreSQL cluster. The system's application logic is refactored to run on AWS Lambda. The API must be accessible only to client microservices running in different VPCs across several AWS accounts within the same AWS Organization, and all traffic must remain private. The Aurora database has a maximum connection limit of 500, whereas the client microservices can generate transient bursts of up to 10,000 requests per second. The Lambda functions require access to sensitive database credentials encrypted with an AWS KMS key. Which architecture most securely and reliably meets these requirements while preventing database connection exhaustion and performance degradation?

  1. A
    Deploy the Lambda functions in the database VPC and configure them to connect directly to the Aurora database endpoints. Create a public REST API in Amazon API Gateway. Secure the API using an AWS Lambda Authorizer. Route outbound client traffic through a single NAT Gateway deployed in a single Availability Zone within the database VPC to reach the public API endpoint. Encrypt database credentials using a Customer Managed Key in AWS KMS.
  2. B
    Deploy the Lambda functions in the database VPC and configure Amazon RDS Proxy to manage database connection pooling. Leave the Lambda functions' concurrency limits unconfigured to allow the functions to scale freely during client microservice bursts. Create a private REST API in Amazon API Gateway, and create an Interface VPC Endpoint in each client VPC. Encrypt the database credentials using the AWS managed key `aws/lambda` in AWS KMS, and grant the Lambda execution role permissions to use it.
  3. Deploy the Lambda functions in the database VPC and configure Amazon RDS Proxy to manage database connection pooling. Set reserved concurrency limits on the Lambda functions to prevent account-level throttling. Create a private REST API in Amazon API Gateway with a resource policy restricting access to the organization's accounts. In each client VPC, create an Interface VPC Endpoint for API Gateway and access the API via the endpoint's DNS names. Encrypt the database credentials using a Customer Managed Key in AWS KMS, and grant the Lambda execution role decrypt permissions on this key.Cevap
  4. D
    Deploy the Lambda functions in the database VPC and configure Amazon RDS Proxy to manage database connection pooling. Create a private REST API in Amazon API Gateway, and associate its default Route 53 Private Hosted Zone with the database VPC. Rely on cross-account DNS resolution to allow other AWS accounts' VPCs to resolve the endpoint. Encrypt the database credentials using the AWS managed key `aws/lambda` in AWS KMS, and configure a cross-account KMS key policy to grant decrypt access to the client accounts.

Cevap

The correct architecture deploys the Lambda functions in the database VPC, manages connections with Amazon RDS Proxy, configures reserved concurrency, secures private cross-account access via API Gateway private endpoints and resource policies, and uses a Customer Managed Key in AWS KMS.
The correct architecture uses Amazon RDS Proxy to pool database connections, ensuring the database connection limits are not exceeded under peak load. Setting reserved concurrency limits on the Lambda functions protects the regional concurrency pool from exhaustion. Private cross-account API access is securely achieved by deploying Interface VPC Endpoints in the client VPCs and applying an API Gateway resource policy that limits access to the AWS Organization's accounts. Using a Customer Managed Key in AWS KMS enables key policy modifications necessary to delegate decrypt permissions to the Lambda execution role.

Adım Adım Çözüm

1
Analyze the database scale and connection limits.
Determine that direct database connections will be exhausted during transient bursts of 10,000 requests per second. Implement Amazon RDS Proxy to queue and reuse database connections.
Prevents database connection saturation while avoiding scaling bottlenecks.
2
Protect the regional concurrency limits.
Configure reserved concurrency on the Lambda functions to limit their maximum simultaneous executions.
Prevents bursty traffic from consuming all regional execution capacity and throttling other workloads in the account.
3
Design private cross-account endpoint routing.
Create an Amazon API Gateway private API. Apply a resource policy restricting access to the AWS Organization. Provision Interface VPC Endpoints in client VPCs and resolve endpoints using endpoint DNS names.
Ensures that traffic does not transit the public internet and VPC DNS name resolution functions across account boundaries.
4
Establish secure encryption and decryption delegation.
Encrypt the credentials with a Customer Managed Key in AWS KMS. Grant the Lambda execution role decrypt permissions on the key.
AWS-managed keys (like `aws/lambda`) cannot have their policies modified to delegate access, making a Customer Managed Key necessary.

Anahtar Kavram

Modernizing legacy workloads using secure private API Gateway configurations, database connection pooling with RDS Proxy, Lambda concurrency management, and proper KMS key policy delegation.
Bu soruyu puanla

Konular

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

Bu konudan daha fazla soru