AWS Certified Database – Specialty — Question 353

A pharmaceutical company uses Amazon Quantum Ledger Database (Amazon QLDB) to store its clinical trial data records. The company has an application that runs as AWS Lambda functions. The application is hosted in the private subnet in a VPC.
The application does not have internet access and needs to read some of the clinical data records. The company is concerned that traffic between the QLDB ledger and the VPC could leave the AWS network. The company needs to secure access to the QLDB ledger and allow the VPC traffic to have read-only access.
Which security strategy should a database specialist implement to meet these requirements?

Answer options

• A. Move the QLDB ledger into a private database subnet inside the VPC. Run the Lambda functions inside the same VPC in an application private subnet. Ensure that the VPC route table allows read-only flow from the application subnet to the database subnet.
• B. Create an AWS PrivateLink VPC endpoint for the QLDB ledger. Attach a VPC policy to the VPC endpoint to allow read-only traffic for the Lambda functions that run inside the VPC.
• C. Add a security group to the QLDB ledger to allow access from the private subnets inside the VPC where the Lambda functions that access the QLDB ledger are running.
• D. Create a VPN connection to ensure pairing of the private subnet where the Lambda functions are running with the private subnet where the QLDB ledger is deployed.

Correct answer: B

Explanation

Amazon QLDB is a fully managed, serverless ledger database that cannot be deployed directly inside a customer's VPC, making options A, C, and D incorrect as they assume QLDB resides in a subnet or supports security groups. To establish private connectivity without traffic leaving the AWS network, an AWS PrivateLink VPC endpoint for QLDB must be created. Attaching a custom VPC endpoint policy allows the database specialist to restrict access to read-only actions for the Lambda functions.