SAA-C03 · Question #496
A company uses AWS Lambda functions in a private subnet in a VPC to run application logic. The Lambda functions must not have access to the public internet. Additionally, all data communication must…
The correct answer is B. Create a gateway VPC endpoint for DynamoDB to provide access to the table. You cannot "place" DynamoDB inside a VPC. Instead, you use a VPC endpoint. A Gateway VPC Endpoint for DynamoDB enables private connectivity between your VPC and DynamoDB without traversing the public internet. "Use a gateway VPC endpoint to privately connect your VPC to…
Question
A company uses AWS Lambda functions in a private subnet in a VPC to run application logic. The Lambda functions must not have access to the public internet. Additionally, all data communication must remain within the private network. As part of a new requirement, the application logic needs access to an Amazon DynamoDB table. What is the MOST secure way to meet this new requirement?
Options
- AProvision the DynamoDB table inside the same VPC that contains the Lambda functions.
- BCreate a gateway VPC endpoint for DynamoDB to provide access to the table.
- CUse a network ACL to only allow access to the DynamoDB table from the VPC.
- DUse a security group to only allow access to the DynamoDB table from the VPC.
How the community answered
(40 responses)- A5% (2)
- B90% (36)
- C3% (1)
- D3% (1)
Explanation
You cannot "place" DynamoDB inside a VPC. Instead, you use a VPC endpoint. A Gateway VPC Endpoint for DynamoDB enables private connectivity between your VPC and DynamoDB without traversing the public internet. "Use a gateway VPC endpoint to privately connect your VPC to DynamoDB without requiring an internet gateway or NAT."
Community Discussion
No community discussion yet for this question.