A regional transit authority is modernizing its legacy commuter fare validation system by migrating to a serverless architecture on AWS. The system must process tap-in events from subway station turnstiles via an Amazon API Gateway Private REST API. An AWS Lambda function will run in private VPC subnets to validate the commuters' cards against a central MySQL database hosted on an Amazon RDS instance. The Lambda function must also query third-party transit APIs on the internet and securely share encrypted commuter validation logs with external partner transportation databases in separate AWS accounts. The solution must ensure high availability, prevent database connection exhaustion, protect the AWS account's execution capacity during morning rush hour spikes, and secure cross-account data sharing. Which architecture should a solutions architect recommend to satisfy these requirements?
- Configure an API Gateway Private REST API using interface VPC endpoints. Deploy the Lambda function across three Availability Zones (AZs) in the private subnets, using Amazon RDS Proxy to manage connection pooling to the MySQL instance. Deploy a NAT Gateway in a public subnet within each AZ to handle outbound internet traffic. Configure a reserved concurrency limit on the Lambda function to safeguard the account's unreserved concurrency pool, and use a customer managed KMS key with a modified key policy to encrypt the shared validation logs.Cevap
- BConfigure an API Gateway Private REST API using interface VPC endpoints. Deploy the Lambda function across three Availability Zones (AZs) in the private subnets, using Amazon RDS Proxy to manage connection pooling to the MySQL instance. Deploy a single NAT Gateway in one public subnet, and configure the route tables of all private subnets to route outbound traffic through it. Configure a reserved concurrency limit on the Lambda function to safeguard the account's unreserved concurrency pool, and use a customer managed KMS key with a modified key policy to encrypt the shared validation logs.
- CConfigure an API Gateway Private REST API using interface VPC endpoints. Deploy the Lambda function across three Availability Zones (AZs) in the private subnets, using Amazon RDS Proxy to manage connection pooling to the MySQL instance. Deploy a NAT Gateway in a public subnet within each AZ to handle outbound internet traffic. Configure a reserved concurrency limit on the Lambda function to safeguard the account's unreserved concurrency pool, and use the default AWS-managed KMS key for Lambda with a modified key policy to encrypt the shared validation logs.
- DConfigure an API Gateway Private REST API using interface VPC endpoints. Deploy the Lambda function across three Availability Zones (AZs) in the private subnets, using Amazon RDS Proxy to manage connection pooling to the MySQL instance. Deploy a NAT Gateway in a public subnet within each AZ to handle outbound internet traffic. Allow the Lambda function to scale dynamically using the default regional unreserved concurrency pool to handle peak load, and use a customer managed KMS key with a modified key policy to encrypt the shared validation logs.
Cevap
Configure an API Gateway Private REST API using interface VPC endpoints. Deploy the Lambda function across three Availability Zones (AZs) in the private subnets, using Amazon RDS Proxy to manage connection pooling to the MySQL instance. Deploy a NAT Gateway in a public subnet within each AZ to handle outbound internet traffic. Configure a reserved concurrency limit on the Lambda function to safeguard the account's unreserved concurrency pool, and use a customer managed KMS key with a modified key policy to encrypt the shared validation logs.
The correct architecture integrates API Gateway Private endpoints for secure internal routing, utilizes RDS Proxy to scale MySQL connection pooling, ensures redundant NAT Gateways across all three Availability Zones to prevent a single point of failure for outbound internet API calls, uses reserved concurrency to safeguard the account's unreserved pool during peak traffic surges, and deploys a customer managed KMS key to support the necessary cross-account decryption permissions.
Adım Adım Çözüm
Anahtar Kavram
Modernizing legacy relational workloads using serverless architectures requires orchestrating private endpoint integrations, database connection management, redundant NAT gateway configurations for outbound API calls, concurrency control for throttling mitigation, and customer managed KMS keys for cross-account security.
Tahmini Süre:3m 0s