DVA-C02 · Question #362
A company is developing a serverless application by using AWS Lambda functions. One of the Lambda functions needs to access an Amazon RDS DB instance. The DB instance is in a private subnet inside a…
The correct answer is D. Configure the Lambda function to connect to the private subnets in the VPC. Add security group. For a Lambda function to reach an Amazon RDS instance in a private VPC subnet, the function itself must be configured to run inside the VPC with the correct subnets and security group rules allowing outbound connectivity to the DB instance.
Question
A company is developing a serverless application by using AWS Lambda functions. One of the Lambda functions needs to access an Amazon RDS DB instance. The DB instance is in a private subnet inside a VPC. The company creates a role that includes the necessary permissions to access the DB instance. The company then assigns the role to the Lambda function. A developer must take additional action to give the Lambda function access to the DB instance. What should the developer do to meet these requirements?
Options
- AAssign a public IP address to the DB instance. Modify the security group of the DB instance to
- BSet up an AWS Direct Connect connection between the Lambda function and the DB instance.
- CConfigure an Amazon CloudFront distribution to create a secure connection between the Lambda
- DConfigure the Lambda function to connect to the private subnets in the VPC. Add security group
How the community answered
(28 responses)- A11% (3)
- C4% (1)
- D86% (24)
Why each option
For a Lambda function to reach an Amazon RDS instance in a private VPC subnet, the function itself must be configured to run inside the VPC with the correct subnets and security group rules allowing outbound connectivity to the DB instance.
Assigning a public IP to the RDS instance exposes a sensitive database to the internet, violating security best practices, and does not resolve the routing issue for a Lambda function that is not VPC-attached.
AWS Direct Connect is a physical network link between an on-premises data center and AWS; it is not applicable for Lambda-to-RDS connectivity within the same AWS account.
Amazon CloudFront is a content delivery network for HTTP/HTTPS workloads and cannot proxy TCP database connections between Lambda and an RDS instance.
Configuring the Lambda function's VPC settings (private subnets and a security group) places its elastic network interface inside the VPC, enabling it to route traffic to the RDS instance over the private network; the RDS security group must then have an inbound rule permitting traffic from the Lambda function's security group on the database port.
Concept tested: Lambda VPC configuration for private subnet resource access
Source: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html
Community Discussion
No community discussion yet for this question.