Answer-first summary for fast verification
Answer: Configure a Secrets Manager interface VPC endpoint. Include the Lambda function's private subnet during the configuration process.
The correct answer is D. The issue arises because the Lambda function, residing in a VPC with no internet access, cannot reach AWS Secrets Manager which operates outside the VPC. To solve this, an interface VPC endpoint for Secrets Manager should be configured. This endpoint enables the Lambda function to securely communicate with Secrets Manager without the need for internet access. Including the Lambda function's private subnet in this configuration ensures that the necessary network path is established for the function to reach Secrets Manager and rotate the secret.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
A company operates an Amazon RDS for MySQL database instance within a VPC that is configured to be isolated from the internet, both for inbound and outbound traffic. A security engineer is tasked with automating the rotation of database credentials using AWS Secrets Manager. Due to organizational security policies, the engineer is prohibited from using the default AWS Lambda function provided by Secrets Manager for this purpose. Consequently, a custom Lambda function has been deployed within the same VPC to manage the rotation of secrets in Secrets Manager. The engineer has also adjusted the security group of the RDS instance to allow connections from the custom Lambda function. Despite these measures, the Lambda function is unable to successfully communicate with Secrets Manager to perform the secret rotation when invoked. What corrective action should the security engineer take to ensure the Lambda function can effectively rotate the secret in Secrets Manager?
A
Add an egress-only internet gateway to the VPC. Allow only the Lambda function's subnet to route traffic through the egress-only internet gateway.
B
Add a NAT gateway to the VPC. Configure only the Lambda function's subnet with a default route through the NAT gateway.
C
Configure a VPC peering connection to the default VPC for Secrets Manager. Configure the Lambda function's subnet to use the peering connection for routes.
D
Configure a Secrets Manager interface VPC endpoint. Include the Lambda function's private subnet during the configuration process.
No comments yet.