A developer is deploying a new Node.js AWS Lambda function that is not connected to a VPC. The Lambda function needs to connect to and query an Amazon Aurora database that is not publicly accessible.

Amazon RDS Proxy sits between Lambda and Aurora, maintaining a warm pool of persistent database connections. When Lambda experiences traffic surges, RDS Proxy multiplexes thousands of Lambda invocations over a smaller set of long-lived connections, preventing Aurora from being overwhelmed. RDS Proxy also provides a stable endpoint that Lambda can connect to, resolving the private connectivity requirement.

A NAT gateway enables outbound internet access from private subnets; it does not provide access to a non-publicly accessible Aurora database, and Lambda in this scenario is not attached to a VPC.

Making the Aurora database publicly accessible introduces a significant security risk and is contrary to best practices for database exposure.

Enabling VPC access for Lambda would allow network connectivity to Aurora, but without RDS Proxy it does not address the connection exhaustion problem caused by unpredictable Lambda concurrency surges.