Q64 — AWS SAA-C03 Ch.12

Question 64 of 100 | ← Chapter 12

Q864. A company runs an AWS Lambda function in private subnets in a VPC. The subnets have a default route to the internet through an Amazon EC2 NAT instance. The Lambda function processes input data and saves its output as an object to Amazon S3.Intermittently, the Lambda function times out while trying to upload the object because of saturated traffic on the NAT instance's network. The company wants to access Amazon S3 without traversing the internet.Which solution will meet these requirements?

Correct Answer: C. Provision a gateway endpoint for Amazon S3 in the VPUpdate the route tables of the subnets accordingly.

Explanation

To meet the requirement of accessing Amazon S3 from an AWS Lambda function in private subnets without traversing the internet and resolving intermittent timeouts due to saturated traffic on the NAT instance's network, the recommended solution is:C. Provision a gateway endpoint for Amazon S3 in the VPC and update the route tables of the subnets accordingly.Here's why:Option C suggests provisioning a gateway endpoint for Amazon S3 in the VPC and updating the route tables of the subnets accordingly. This solution allows the Lambda function running in the private subnets to access Amazon S3 directly without going through the internet.By creating a gateway endpoint for Amazon S3, the Lambda function can communicate with Amazon S3 securely and privately within the VPC. The traffic between the Lambda function and Amazon S3 does not traverse the internet, eliminating the dependency on the NAT instance and the associated network congestion issues.To implement this solution, you would need to create a VPC endpoint for Amazon S3 in the VPC where the Lambda function resides. This endpoint allows the Lambda function to access Amazon S3 using private IP addresses. Additionally, you would need to update the route tables of the subnets to direct the traffic intended for Amazon S3 to use the gateway endpoint instead of the NAT instance.Option A suggests replacing the EC2 NAT instance with an AWS managed NAT gateway. While using a managed NAT gateway can provide better scalability and availability compared to a single EC2 NAT instance, it does not directly address the requirement of accessing Amazon S3 without traversing the internet.Option B suggests increasing the size of the EC2 NAT instance in the VPC to a network optimized instance type. While increasing the size of the NAT instance might help alleviate some network congestion issues, it does not eliminate the need for internet access and does not directly address the requirement of accessing Amazon S3 without traversing the internet.Option D suggests provisioning a transit gateway and placing transit gateway attachments in the private subnets where the Lambda function is running. While transit gateways can provide connectivity between VPCs and on-premises networks, it is not necessary for the specific requirement of accessing Amazon S3 without traversing the internet. It introduces additional complexity and may not be the most straightforward solution for this scenario.In summary, the recommended solution is to provision a gateway endpoint for Amazon S3 in the VPC and update the route tables of the subnets accordingly. This solution enables the Lambda function to directly access Amazon S3 without relying on the internet or the NAT instance, resolving the intermittent timeouts caused by network congestion.