DVA-C02 Question 64
Select 3You are developing an AWS Lambda function that needs to access resources within a private subnet of a VPC, such as an Amazon RDS database. What steps must you take to enable the Lambda function to access these private resources?
- A
Attach the Lambda function to the same VPC and subnet where the private resources reside.
- B
Create a VPC endpoint for Lambda to access the private resources within the VPC.
- C
Configure the Lambda function with a VPC configuration, specifying the subnet IDs and security groups.
- D
Ensure the Lambda function has the necessary IAM permissions to access the private resources.
- E
Set up a NAT Gateway or NAT Instance if the Lambda function needs internet access in addition to private resource access.
Show answer and explanation
Correct answers: C, D, E
Explanation
To enable a Lambda function to access private resources within a VPC, you must configure the Lambda function with the appropriate VPC settings, including subnet IDs and security groups. Additionally, the Lambda function needs the required IAM permissions to interact with the private resources. If internet access is also needed, such as for making API calls, a NAT Gateway or NAT Instance must be configured for the private subnets to allow outbound internet connectivity.
- A. Incorrect.
Incorrect. Lambda functions are not 'attached' to a VPC or subnet in the same sense as EC2 instances. Instead, they require explicit VPC configuration, including subnet IDs and security groups.
- B. Incorrect.
Incorrect. VPC endpoints are not required for Lambda to access private resources within the VPC. VPC configuration directly enables access to private subnets.
- C. Correct.
Correct. Configuring the Lambda function with VPC settings (subnets and security groups) ensures it can connect to private resources in those subnets.
- D. Correct.
Correct. The Lambda function must have the appropriate IAM permissions to access the private resources, such as access to an RDS database or an S3 bucket.
- E. Correct.
Correct. If the Lambda function needs internet access in addition to private resource access, a NAT Gateway or NAT Instance is required for outbound internet access from private subnets.