Examkin

Soru

Zorluk: ZorModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

An enterprise is migrating a legacy B2B transaction processing application to a serverless architecture on AWS. External customer accounts must securely access the API without traversing the public internet. The backend consists of AWS Lambda functions running inside a private VPC subnet that write transactions to an Amazon Aurora PostgreSQL database. During peak B2B upload cycles, the database suffers from connection exhaustion. The Solutions Architect needs to design a secure, highly scalable, and cost-effective solution.

Which TWO actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Deploy a private Amazon API Gateway endpoint in the provider account, and instruct consumers to configure an interface VPC endpoint for API Gateway in their own VPCs. Apply an API Gateway resource policy that restricts access to the VPC endpoint IDs of the consumers.Cevap
  2. Provision an Amazon RDS Proxy in the private subnets where the database resides and configure the Lambda functions to point to the proxy endpoint. Configure reserved concurrency on the Lambda functions.Cevap
  3. C
    Configure client-side connection pooling within the Lambda function's initialization code to manage database connections. Leave the regional account concurrency pool unconfigured so the Lambda functions can scale dynamically.
  4. D
    Configure an Application Load Balancer to route traffic to the Lambda functions, and deploy a Route 53 weighted routing policy between two ALBs to execute zero-downtime rolling canary deployments for function updates.
  5. E
    Deploy a single NAT Gateway in a public subnet to route outbound database traffic from the Lambda functions in the private subnets to the Aurora PostgreSQL database over the public internet using the public database endpoint.
  6. F
    Configure API Gateway to encrypt the incoming payloads using the default AWS-managed KMS key for API Gateway, and update the default key policy to delegate cross-account decryption access to the IAM roles in the consumer AWS accounts.

Cevap

Deploy a private Amazon API Gateway endpoint with cross-account interface VPC endpoints and an API Gateway resource policy to restrict access. Additionally, provision an Amazon RDS Proxy in the private subnets and configure reserved concurrency on the Lambda functions.
Deploying a private API Gateway endpoint combined with interface VPC endpoints in consumer accounts secures cross-account communication over the AWS backbone network without exposure to the public internet. Restricting access using resource policies ensures only authorized consumers can reach the API. Additionally, using Amazon RDS Proxy resolves database connection exhaustion by pooling connections from Lambda execution environments, while configuring reserved concurrency controls the maximum concurrent executions of the Lambda functions, protecting the database from overloading and preventing the exhaustion of the regional Lambda concurrency limit.

Adım Adım Çözüm

1
Select the correct cross-account private API access mechanism.
A private API Gateway endpoint is created, with interface VPC endpoints deployed in the consumer accounts and a resource policy applied to restrict access to those VPC endpoint IDs.
This configuration routes API calls privately over the AWS backbone network without exposing endpoints to the public internet.
2
Address database connection limits under serverless scale-out.
An Amazon RDS Proxy is provisioned in the VPC's private subnets, and the Lambda functions are updated to target the proxy endpoint.
Because Lambda functions are short-lived and scale horizontally, client-side connection pooling is ineffective. RDS Proxy pools and shares connections to prevent database connection exhaustion.
3
Apply concurrency controls at the compute layer.
Reserved concurrency is configured on the target Lambda functions.
Reserved concurrency prevents a traffic spike from consuming all available concurrency in the AWS region, which protects other workloads from throttling and sets an upper limit on connections spawned toward the RDS Proxy.

Anahtar Kavram

API Gateway private endpoints enable secure cross-account API integrations via interface VPC endpoints, while Amazon RDS Proxy and reserved concurrency mitigate database connection limits and account-level throttling in highly concurrent Lambda architectures.
Bu soruyu puanla

Konular

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

Bu konudan daha fazla soru