A company is modernizing a legacy, on-premises payment settlement service by migrating it to a serverless architecture on AWS. The solution must expose a private API to external financial partners connecting via AWS Direct Connect. The partners authenticate using JSON Web Tokens (JWT) issued by a third-party Identity Provider (IdP). The backend consists of AWS Lambda functions that query an Amazon Aurora PostgreSQL database cluster.
The architecture must satisfy the following requirements:
- Partners must access the API securely over the private network connection without exposing traffic to the public internet.
- The database must be protected from connection exhaustion during sudden traffic spikes.
- The application must prevent the payment settlement workload from exhausting the regional unreserved Lambda concurrency pool, which would starve other critical services in the same AWS account.
Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)
- Create a private Amazon API Gateway REST API associated with interface VPC endpoints. Configure an API Gateway Lambda authorizer to validate the JWT tokens from the external Identity Provider.Cevap
- Deploy an Amazon RDS Proxy between the Lambda functions and the Aurora PostgreSQL database cluster. Configure a reserved concurrency limit on the Lambda functions.Cevap
- CCreate a regional Amazon API Gateway REST API and configure a custom domain name. Integrate it with the Lambda functions configured with unlimited unreserved concurrency to handle sudden partner traffic spikes without throttling.
- DModify the default AWS-managed KMS key (aws/apigateway) key policy to delegate decrypt permissions to the partner AWS accounts to allow secure payload decryption.
- EDeploy the Lambda functions in a single private subnet and route all database-bound traffic through a single NAT Gateway in a public subnet to ensure static IP routing to the database.