A financial services company is modernizing its legacy transaction auditing API by migrating it to a serverless architecture on AWS. The application consists of an Amazon API Gateway REST API backed by AWS Lambda functions. The audit records must be written to an Amazon RDS PostgreSQL database deployed in private subnets. During end-of-month processing, the API experiences massive, unpredictable traffic spikes that exhaust the database connection pool. The Solutions Architect must design a highly available, secure solution. The solution must prevent the transaction auditing Lambda functions from consuming all execution capacity in the AWS region, which would throttle other critical applications. Additionally, database credentials must be managed securely, supporting rotation triggered from a centralized deployment pipeline in a separate security AWS account. Which configuration meets these requirements while adhering to the AWS Well-Architected Framework?
- Configure Amazon RDS Proxy between the Lambda functions and the PostgreSQL database. Deploy the Lambda functions in multiple private subnets across different Availability Zones with a configured reserved concurrency limit. Store database credentials in AWS Secrets Manager using a Customer Managed Key, configuring a custom key policy to allow access and rotation from the central security account. Deploy VPC interface endpoints to allow the Lambda functions to access Secrets Manager.Cevap
- BConfigure Amazon RDS Proxy between the Lambda functions and the PostgreSQL database. Deploy the Lambda functions in multiple private subnets across different Availability Zones, and configure provisioned concurrency to handle execution spikes while leaving the regional execution limit unconstrained. Store database credentials in AWS Secrets Manager using a Customer Managed Key with a custom key policy. Deploy VPC interface endpoints to access Secrets Manager.
- CConfigure Amazon RDS Proxy between the Lambda functions and the PostgreSQL database. Deploy the Lambda functions in multiple private subnets across different Availability Zones with a configured reserved concurrency limit. Store database credentials in AWS Secrets Manager encrypted with the default AWS-managed KMS key, and grant cross-account rotation access to the central security account by updating the AWS-managed KMS key policy. Deploy VPC interface endpoints to access Secrets Manager.
- DConfigure Amazon RDS Proxy between the Lambda functions and the PostgreSQL database. Deploy the Lambda functions in a single private subnet to minimize networking complexity, routing all outbound internet and AWS service traffic through a single NAT Gateway in that Availability Zone. Set a configured reserved concurrency limit on the Lambda functions. Store database credentials in AWS Secrets Manager using a Customer Managed Key.