DVA-C02 practice question 9 of 35

A developer is creating an AWS Lambda function that needs network access to private resources in a VPC.

Domain Development with AWS Services

Answer options

A: Attach the Lambda function to the VPC through private subnets. Create a security group that allows network access to the private resources. Associate the security group with the Lambda function. Correct answer

B: Configure the Lambda function to route traffic through a VPN connection. Create a security group that allows network access to the private resources. Associate the security group with the Lambda function.

C: Configure a VPC endpoint connection for the Lambda function. Set up the VPC endpoint to route traffic through a NAT gateway.

D: Configure an AWS PrivateLink endpoint for the private resources. Configure the Lambda function to reference the PrivateLink endpoint.

Correct Answer:

A. Attach the Lambda function to the VPC through private subnets. Create a security group that allows network access to the private resources. Associate the security group with the Lambda function.

Explanation

To grant an AWS Lambda function access to resources within a Virtual Private Cloud (VPC), you must configure it to connect to that VPC. This process involves creating an Elastic Network Interface (ENI) within the specified private subnets of the VPC. By placing the function in private subnets, it can communicate with other resources, such as databases or EC2 instances, using their private IP addresses. A security group must be associated with the Lambda function's ENI to act as a virtual firewall, with rules that explicitly allow traffic to and from the target private resources. This is the standard and most direct method for this use case.

Why Incorrect

B: A VPN connection is primarily for connecting an on-premises network or another VPC to your VPC, not for a Lambda function to access resources within the same VPC. C: A VPC endpoint is used for private access to supported AWS services (like S3 or DynamoDB) from within a VPC, not for a Lambda function to access general private resources like an RDS database. D: AWS PrivateLink is a more complex solution designed to expose a service in one VPC to consumers in another VPC securely, which is unnecessary for intra-VPC communication.

References

1. AWS Lambda Developer Guide

Configuring a Lambda function to access resources in a VPC: "When you connect a function to a VPC

Lambda creates an elastic network interface (ENI) for each combination of security group and subnet in your function's VPC configuration... To connect to private resources

connect your function to private subnets."

2. AWS VPC User Guide

Security groups: "A security group acts as a virtual firewall for your instance to control inbound and outbound traffic... When you associate a security group with an ENI that's attached to a Lambda function

you can control the inbound and outbound traffic for the function." (Section: Security group basics).

3. AWS VPC User Guide

What is a VPC endpoint?: "A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by AWS PrivateLink without requiring an internet gateway

NAT device

VPN connection

or AWS Direct Connect connection." (This clarifies the purpose of VPC endpoints is for AWS services

not general resources within the VPC).

Keep practicing

Take the free DVA-C02 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test