Lambda and VPC access: DVA-C03 study notes and practice questions
What to know about Lambda and VPC access for the DVA-C03 exam, from the Development with AWS Services domain (30% of the exam guide), then 1 free question to test it. Part of the DVA-C03 study guide.
VPC questions describe a function that must reach a private database, a public partner API, or AWS services, and then ask what is missing. Work out what the function must reach, then pick the network path that does it.
How a VPC function connects
You attach the function to one or more private subnets and one or more security groups. Lambda creates Hyperplane ENIs in those subnets. Functions that use the same subnet and security group combination can share an ENI.
A public subnet does not help. Attaching a function to one gives it no internet access and no public IP address.
A new VPC function stays Pending while its ENI is created, which can take several minutes. It can’t be invoked until it is Active.
A function idle for 14 days can have its ENIs reclaimed. Don’t design around ENI persistence.
Permissions
The execution role needs the managed policy AWSLambdaVPCAccessExecutionRole. The console adds it when you attach a function to a VPC.
The error “the provided execution role does not have permissions to call CreateNetworkInterface” means this policy (or its EC2 actions) is missing.
The user or role that attaches the function needs ec2:DescribeSecurityGroups, ec2:DescribeSubnets, ec2:DescribeVpcs and ec2:GetSecurityGroupsForVpc.
How to choose
Scenario wording
Answer
Function must reach a database in private subnets
Attach to the VPC; allow the function’s security group in the database’s security group
Function must call a public third-party API
NAT gateway in a public subnet, with a route from the private subnets
Partner allows only one fixed public IP
NAT gateway with an Elastic IP address
Function calls S3 or DynamoDB and must avoid NAT costs
Gateway VPC endpoint
Function calls Secrets Manager or another AWS API with no internet route
Interface VPC endpoint (AWS PrivateLink)
Hundreds of concurrent instances exhaust database connections
RDS Proxy, which pools connections
Common traps
Public subnet for internet access. The fix is a NAT gateway, not a public subnet.
Making the database public so a private function can reach it. Keep the database private and open it to the function’s security group.
Adding a NAT gateway for S3 or DynamoDB traffic when a gateway endpoint costs nothing extra.
Ignoring connection limits. Scaling to many instances opens many database connections.
Outbound IPv6. It is off by default and needs every connected subnet to be dual-stack.
A Lambda function is attached to private subnets so that it can query an Amazon RDS database, which must stay private.
The function must also call a payment provider's HTTPS API. The provider accepts requests only from one fixed public IP address that the company has registered with it. Calls to the provider currently time out.
The company will not open the database to the internet.
Which change meets these requirements?
Choose one answer.
AA. Move the function into the VPC's public subnets, so that its traffic leaves through the internet gateway.
BB. Add a route from the private subnets to the internet gateway, and allow outbound traffic in the security group.
CC. Create a NAT gateway in a public subnet with an Elastic IP, and route the private subnets' traffic to it.
DD. Create an interface VPC endpoint for the payment provider's domain name in the private subnets, and turn on private DNS.
B. Wrong: The function has no public IP address, so the internet gateway cannot carry its traffic. The provider would still never see the fixed address it expects.
C. Right: Correct. Outbound traffic from the private subnets leaves through the NAT gateway, which uses its Elastic IP address. The provider sees that fixed address, and the database stays private. Learn more: NAT gateways (opens in a new tab)
D. Wrong: Interface endpoints reach AWS services and PrivateLink services. They cannot reach an arbitrary third-party API, and they do not give the function a fixed outbound address.
Explanation
A function in private subnets reaches the internet only through a route to a NAT gateway in a public subnet. The NAT gateway's Elastic IP address is the fixed address the provider sees, and the database stays private. Public subnets and internet gateway routes do not give the function a public address.
The provider sees the NAT gateway's Elastic IP, and the database never gets a route to the internet.
Want more on Lambda and VPC access? The 5 full-length practice sets have 5 more Lambda and VPC access questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →