An insurance provider is modernizing its claims intake system by refactoring a legacy API to a serverless architecture on AWS. The new API is deployed using Amazon API Gateway and routes requests to an AWS Lambda function. This function processes the claims, invokes an external third-party API over the internet to validate claim details, and stores the results in an Amazon Aurora PostgreSQL database. During peak periods, the system experiences sudden, massive spikes in traffic. A secondary auditing application in a separate AWS account also needs to retrieve database credentials from AWS Secrets Manager to verify claims data. Which architecture should a solutions architect design to meet these requirements securely and reliably?
- Deploy the Lambda function in private subnets across multiple Availability Zones, and route outbound internet traffic through redundant NAT Gateways. Configure Amazon RDS Proxy to manage connection pooling to the Aurora database. Store the database credentials in AWS Secrets Manager, encrypting them with a Customer Managed Key in AWS KMS to allow cross-account access, and configure a reserved concurrency limit on the Lambda function.Cevap
- BDeploy the Lambda function in private subnets across multiple Availability Zones, and route outbound internet traffic through redundant NAT Gateways. Configure Amazon RDS Proxy to manage connection pooling to the Aurora database. Store the database credentials in AWS Secrets Manager, encrypting them with a Customer Managed Key in AWS KMS. Leave the Lambda function's concurrency limits unconfigured to allow the function to automatically scale to the maximum regional limit during traffic spikes.
- CDeploy the Lambda function in private subnets across multiple Availability Zones, and route all outbound internet traffic through a single NAT Gateway in one Availability Zone to minimize cost. Configure Amazon RDS Proxy to manage connection pooling to the Aurora database. Store the database credentials in AWS Secrets Manager, encrypting them with a Customer Managed Key in AWS KMS, and configure a reserved concurrency limit on the Lambda function.
- DDeploy the Lambda function in private subnets across multiple Availability Zones, and route outbound internet traffic through redundant NAT Gateways. Configure Amazon RDS Proxy to manage connection pooling to the Aurora database. Store the database credentials in AWS Secrets Manager, encrypting them with the AWS-managed KMS key aws/secretsmanager to simplify key rotation, and configure a reserved concurrency limit on the Lambda function.
Cevap
Deploying the Lambda function in multi-AZ private subnets with redundant NAT Gateways, using RDS Proxy for connection pooling, encrypting Secrets Manager secrets using a Customer Managed KMS key, and configuring reserved concurrency on the Lambda function.
The correct architecture configures RDS Proxy to prevent database connection exhaustion, places the Lambda function in a multi-AZ private subnet with redundant NAT Gateways to ensure highly available outbound connectivity for third-party API validation, uses a Customer Managed Key in KMS to allow cross-account key delegation to the auditing application, and configures a reserved concurrency limit on the Lambda function to protect the rest of the account's regional concurrency capacity from being exhausted by unexpected claims ingestion spikes.
Adım Adım Çözüm
Anahtar Kavram
Designing secure, highly-available serverless architectures integrated with VPCs, relational databases, and cross-account access controls.