AWS Certified Developer – Associate (DVA-C02)SecurityHard
A developer is building a new application that needs to call an external third-party API that requires requests to originate from a static, known IP address for security whitelist purposes. The application runs on AWS Lambda functions in a VPC. How can the developer configure the Lambda functions to meet this requirement?
- AConfigure the Lambda function to use a NAT Gateway with an Elastic IP address.
- BAttach an Elastic IP address directly to the Lambda function's ENI.
- CUse an API Gateway endpoint with a VPC Link to the Lambda function.
- DDeploy the Lambda function in a public subnet and assign it an Elastic IP address.
Show answer & explanationAnswer & explanation
Correct answer: A. Configure the Lambda function to use a NAT Gateway with an Elastic IP address.
To ensure Lambda functions in a VPC have a static, known outbound IP address, they must be configured to route their traffic through a NAT Gateway. The NAT Gateway is provisioned with an Elastic IP address, which provides the static public IP for all outbound traffic from the private subnet.
Why the other options are wrong
- B. Elastic IP addresses cannot be directly attached to a Lambda function's ENI; they are associated with network interfaces of EC2 instances or NAT Gateways.
- C. API Gateway with a VPC Link is for exposing private VPC resources to API Gateway, not for providing static outbound IPs for Lambda functions.
- D. Deploying Lambda in a public subnet directly would expose it to the internet and it would still receive dynamic public IPs unless a NAT (or similar) is used with an EIP, which is not the standard secure pattern.
Lambda Static Egress IP
To provide a static, known outbound IP address for AWS Lambda functions running in a VPC, configure them in a private subnet and route their outbound traffic through a NAT Gateway with an associated Elastic IP address.
- Lambda in VPC gets private IP; needs NAT Gateway for internet access.
- NAT Gateway's Elastic IP provides the static public egress IP.
- Required for whitelisting with external services.
Memory trick: NAT Gateway's EIP is Lambda's Exit Point.