AWS Certified Developer – Associate (DVA-C02)Development with AWS ServicesMedium
A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The Lambda function needs to access a database hosted in a private subnet within a Virtual Private Cloud (VPC). The developer has configured the Lambda function to run within the VPC. However, the Lambda function also needs to make outbound calls to third-party APIs on the internet. Which additional networking component is required to allow the Lambda function to reach the internet while remaining in the private subnet?
- AA VPC Endpoint for Amazon S3.
- BAn Internet Gateway attached to the VPC.
- CA NAT Gateway in a public subnet, with a route from the private subnet to the NAT Gateway.
- DA Direct Connect connection to the corporate network.
Show answer & explanationAnswer & explanation
Correct answer: C. A NAT Gateway in a public subnet, with a route from the private subnet to the NAT Gateway.
To allow resources in a private subnet (like a Lambda function configured within a VPC) to access the internet while remaining private, a NAT Gateway must be deployed in a public subnet. Traffic from the private subnet is then routed through the NAT Gateway to the Internet Gateway.
Why the other options are wrong
- A. A VPC Endpoint for Amazon S3 allows private access to S3 without traversing the internet, but it doesn't provide general internet access for third-party APIs.
- B. An Internet Gateway allows internet access for resources in a public subnet, but Lambda is in a private subnet and needs an intermediary.
- D. Direct Connect provides a dedicated network connection from on-premises to AWS, not general internet access for VPC resources.
NAT Gateway
A Network Address Translation (NAT) service that enables instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating a connection with those instances.
- Deployed in a public subnet.
- Requires an Elastic IP address.
- Must have a route table entry from private subnets.
Memory trick: NAT Gateway is the private path to the public internet.