AWS Certified Security – Specialty — Question 299

A company is running an Amazon RDS for MySQL DB instance in a VPC. The VPC must not send or receive network traffic through the internet.

A security engineer wants to use AWS Secrets Manager to rotate the DB instance credentials automatically. Because of a security policy, the security engineer cannot use the standard AWS Lambda function that Secrets Manager provides to rotate the credentials.

The security engineer deploys a custom Lambda function in the VPC. The custom Lambda function will be responsible for rotating the secret in Secrets Manager. The security engineer edits the DB instance's security group to allow connections from this function. When the function is invoked, the function cannot communicate with Secrets Manager to rotate the secret properly.

What should the security engineer do so that the function can rotate the secret?

Answer options

• A. Add an egress-only internet gateway to the VPC. Allow only the Lambda function's subnet to route traffic through the egress-only internet gateway.
• B. Add a NAT gateway to the VPC. Configure only the Lambda function's subnet with a default route through the NAT gateway.
• C. Configure a VPC peering connection to the default VPC for Secrets Manager. Configure the Lambda function's subnet to use the peering connection for routes.
• D. Configure a Secrets Manager interface VPC endpoint. Include the Lambda function's private subnet during the configuration process.

Correct answer: D

Explanation

Because the VPC must not have any internet connectivity, using a NAT gateway or an egress-only internet gateway violates the security policy. AWS Secrets Manager does not reside in a customer-accessible 'default VPC' for peering, making a peering connection invalid. Configuring an interface VPC endpoint (powered by AWS PrivateLink) allows the private Lambda function to communicate securely with Secrets Manager entirely within the AWS network, satisfying the no-internet constraint.