AWS Certified Developer – Associate (DVA-C02)SecurityMedium
A company is developing a serverless application that uses AWS Lambda functions to process highly sensitive data. The Lambda functions need to call a third-party API that requires requests to originate from a fixed, known IP address for whitelisting purposes. How can a developer ensure that the Lambda functions' outbound traffic consistently uses a static IP address?
- AConfigure the Lambda function to run within a VPC and route its outbound traffic through a NAT Gateway.
- BImplement a custom HTTP proxy within the Lambda function code to route traffic.
- CAssign an Elastic IP address directly to the Lambda function's execution environment.
- DUse an AWS Global Accelerator endpoint in front of the Lambda function.
Show answer & explanationAnswer & explanation
Correct answer: A. Configure the Lambda function to run within a VPC and route its outbound traffic through a NAT Gateway.
Placing the Lambda function in a VPC and routing its outbound traffic through a NAT Gateway provides a static, public IP address (the NAT Gateway's Elastic IP) for all egress traffic, satisfying the third-party API's whitelisting requirement.
Why the other options are wrong
- B. Implementing a custom HTTP proxy within the Lambda function itself is overly complex, inefficient, and does not guarantee a static outbound IP address without additional infrastructure like a NAT Gateway or proxy server outside the function.
- C. Elastic IP addresses cannot be directly assigned to Lambda function execution environments. Lambda functions typically have dynamic outbound IPs by default.
- D. AWS Global Accelerator is used for improving availability and performance of applications by routing traffic over the AWS global network; it doesn't provide a static egress IP for Lambda functions.
Lambda Static Egress IP
To provide a Lambda function with a static outbound IP address, it must be configured to run within a VPC, and its outbound traffic routed through a NAT Gateway, which is assigned an Elastic IP.
- Lambda in VPC.
- Outbound through NAT Gateway.
- NAT Gateway has Elastic IP.
- Enables whitelisting by third-party services.
Memory trick: Lambda's VPC NAT Gateway is the static IP's only pathway.