Q18 — AWS SAA-C03 Ch.16

Question 18 of 100 | ← Chapter 16

Q1218. A company uses AWS Lambda functions in a private subnet in a VPC to run application logic. The Lambda functions must not have access to the public internet. Additionally, all data communication must remain within the private network. As part of a new requirement, the application logic needs access to an Amazon DynamoDB table.What is the MOST secure way to meet this new requirement?

Correct Answer: B. Create a gateway VPC endpoint for DynamoDB to provide access to the table.

Explanation

To meet the new requirement of allowing AWS Lambda functions in a private subnet of a VPC to access an Amazon DynamoDB table without granting access to the public internet and ensuring all data communication remains within the private network, the most secure way is:B. Create a gateway VPC endpoint for DynamoDB to provide access to the table.Analysis:Gateway VPC Endpoint for DynamoDB:Functionality: A gateway VPC endpoint for DynamoDB allows your VPC to communicate with DynamoDB without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Traffic between your VPC and DynamoDB remains within the AWS network, enhancing security and compliance.Security: By using a gateway VPC endpoint, you ensure that all data communication between your Lambda functions and DynamoDB stays within the private network, without traversing the public internet. This is the most secure way to meet the requirement.Configuration: Creating a gateway VPC endpoint is straightforward and can be done through the AWS Management Console, AWS CLI, or AWS SDKs. Once created, you can update the route tables of your private subnets to route DynamoDB traffic through the endpoint. Provision the DynamoDB Table Inside the Same VPC (Option A):Inapplicability: DynamoDB is a fully managed NoSQL database service that operates outside of your VPC. It is not possible to provision a DynamoDB table inside a VPC. Use a Network ACL to Only Allow Access to the DynamoDB Table from the VPC (Option C):Inadequacy: Network ACLs operate at the subnet level and provide a basic layer of security by controlling inbound and outbound traffic at the subnet level. However, they do not provide a secure way to access DynamoDB without traversing the public internet. Network ACLs alone cannot ensure that traffic to DynamoDB remains within the private network.Use a Security Group to Only Allow Access to the DynamoDB Table from the VPC (Option D):Inadequacy: Security groups operate at the instance level and provide a stateful firewall for your EC2 instances or Lambda functions. While security groups can restrict access to specific IP addresses or ranges, they do not provide a secure way to access DynamoDB without traversing the public internet. Security groups alone cannot ensure that traffic to DynamoDB remains within the private network. In summary, creating a gateway VPC endpoint for DynamoDB is the most secure way to meet the new requirement of allowing AWS Lambda functions in a private subnet of a VPC to access an Amazon DynamoDB table without granting access to the public internet and ensuring all data communication remains within the private network.