An energy trading firm is modernizing its legacy real-time gas nomination settlement system. The API is hosted on Amazon API Gateway in Account A, which must invoke an AWS Lambda function in Account B. The Lambda function in Account B is deployed inside a VPC across three Availability Zones to securely query an Amazon Aurora PostgreSQL database in Account A via an Amazon RDS Proxy. The database credentials are stored in AWS Secrets Manager in Account A and are encrypted. The Lambda function must also make outbound HTTPS calls to an external public energy pricing index API to fetch daily indexes. To handle sudden settlement spikes, the design must protect Account B from regional concurrency exhaustion and prevent database overload. Outbound internet connectivity must not have a single point of failure. Secrets decryption must work across accounts. Code updates must shift of traffic to the new version, wait minutes for evaluation, and roll back automatically if errors occur. Which architecture design meets these requirements?
- AConfigure API Gateway in Account A with cross-account permissions to invoke the Lambda function in Account B. Deploy the Lambda function in three private subnets in Account B, with the route tables for all three subnets pointing to a single, shared NAT Gateway deployed in one public subnet. Set a reserved concurrency limit on the Lambda function. Encrypt the database credentials in AWS Secrets Manager using a Customer Managed Key (CMK) in Account A, and configure its key policy to allow the Lambda execution role in Account B decrypt permissions. Deploy the function using AWS CodeDeploy with a Canary10Percent10Minutes configuration monitored by CloudWatch alarms.
- BConfigure API Gateway in Account A with cross-account permissions to invoke the Lambda function in Account B. Deploy the Lambda function in three private subnets in Account B, with each subnet's route table pointing to a dedicated NAT Gateway in a public subnet in its respective Availability Zone. Set a reserved concurrency limit on the Lambda function. Encrypt the database credentials in AWS Secrets Manager using the default AWS-managed key aws/secretsmanager in Account A, and configure an IAM policy on the Lambda execution role in Account B to allow decryption of this key. Deploy the function using AWS CodeDeploy with a Canary10Percent10Minutes configuration monitored by CloudWatch alarms.
- Configure API Gateway in Account A with cross-account permissions to invoke the Lambda function in Account B. Deploy the Lambda function in three private subnets in Account B, with each subnet's route table pointing to a dedicated NAT Gateway in a public subnet in its respective Availability Zone. Set a reserved concurrency limit on the Lambda function. Encrypt the database credentials in AWS Secrets Manager using a Customer Managed Key (CMK) in Account A, and configure its key policy to allow the Lambda execution role in Account B decrypt permissions. Deploy the function using AWS CodeDeploy with a Canary10Percent10Minutes configuration monitored by CloudWatch alarms.Cevap
- DConfigure API Gateway in Account A with cross-account permissions to invoke the Lambda function in Account B. Deploy the Lambda function in three private subnets in Account B, with each subnet's route table pointing to a dedicated NAT Gateway in a public subnet in its respective Availability Zone. Do not configure a reserved concurrency limit on the Lambda function, allowing it to scale using the regional pool, and rely on the RDS Proxy in Account A to manage database connections. Encrypt the database credentials in AWS Secrets Manager using a Customer Managed Key (CMK) in Account A, and configure its key policy to allow the Lambda execution role in Account B decrypt permissions. Deploy the function using AWS CodeDeploy with a Canary10Percent10Minutes configuration monitored by CloudWatch alarms.
Cevap
Configure API Gateway in Account A with cross-account permissions to invoke the Lambda function in Account B. Deploy the Lambda function in three private subnets in Account B, with each subnet's route table pointing to a dedicated NAT Gateway in a public subnet in its respective Availability Zone. Set a reserved concurrency limit on the Lambda function. Encrypt the database credentials in AWS Secrets Manager using a Customer Managed Key (CMK) in Account A, and configure its key policy to allow the Lambda execution role in Account B decrypt permissions. Deploy the function using AWS CodeDeploy with a Canary10Percent10Minutes configuration monitored by CloudWatch alarms.
The correct solution addresses all cross-account, security, routing, performance, and deployment requirements. It uses a Customer Managed Key (CMK) with a custom key policy in Account A, permitting the execution role in Account B to decrypt the database credentials. It ensures high availability for outbound pricing calls by configuring redundant NAT Gateways across all three Availability Zones. It also prevents regional concurrency pool exhaustion by setting a reserved concurrency limit on the Lambda function, and employs AWS CodeDeploy with a Canary10Percent10Minutes configuration along with CloudWatch alarms to execute safe, automated rollbacks.
Adım Adım Çözüm
Anahtar Kavram
Designing secure, resilient, and performant serverless architectures spanning multiple AWS accounts and VPCs.