A developer is creating an AWS Lambda function that needs network access to private resources in a VPC.

To grant an AWS Lambda function access to resources within a Virtual Private Cloud (VPC), you must configure it to connect to that VPC. This process involves creating an Elastic Network Interface (ENI) within the specified private subnets of the VPC. By placing the function in private subnets, it can communicate with other resources, such as databases or EC2 instances, using their private IP addresses. A security group must be associated with the Lambda function's ENI to act as a virtual firewall, with rules that explicitly allow traffic to and from the target private resources. This is the standard and most direct method for this use case.

B: A VPN connection is primarily for connecting an on-premises network or another VPC to your VPC, not for a Lambda function to access resources within the same VPC.

C: A VPC endpoint is used for private access to supported AWS services (like S3 or DynamoDB) from within a VPC, not for a Lambda function to access general private resources like an RDS database.

D: AWS PrivateLink is a more complex solution designed to expose a service in one VPC to consumers in another VPC securely, which is unnecessary for intra-VPC communication.

1. AWS Lambda Developer Guide

Configuring a Lambda function to access resources in a VPC: "When you connect a function to a VPC

Lambda creates an elastic network interface (ENI) for each combination of security group and subnet in your function's VPC configuration... To connect to private resources

connect your function to private subnets."

2. AWS VPC User Guide

Security groups: "A security group acts as a virtual firewall for your instance to control inbound and outbound traffic... When you associate a security group with an ENI that's attached to a Lambda function

you can control the inbound and outbound traffic for the function." (Section: Security group basics).

3. AWS VPC User Guide

What is a VPC endpoint?: "A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by AWS PrivateLink without requiring an internet gateway

NAT device

VPN connection

or AWS Direct Connect connection." (This clarifies the purpose of VPC endpoints is for AWS services

not general resources within the VPC).