A Node.js function runs on AWS Lambda and must query a PostgreSQL database that sits in private subnets with no public IP address. The function is currently deployed with default networking. What should the team change?
Show answer and explanation
Answer: C
Lambda functions run outside your VPC by default and cannot reach resources in private subnets until you attach them. VPC configuration means choosing subnets and a security group for the function. The database security group then needs an inbound rule on the database port that references the function's security group, and the function's outbound rules must allow that traffic. Keeping the database private is the right design, so making it public or routing through an internet gateway would expose it without solving the networking problem.
Why the other options are wrong
- A. Making the database publicly reachable is unnecessary for a function that can join the same VPC, and it widens exposure to the internet, which goes against the purpose of a private subnet.
- B. An internet gateway route does not help a function that is not attached to the VPC, and opening the database port to the internet would expose the data without fixing the connectivity.
- D. Direct Connect links an on-premises network to AWS and does not connect a Lambda function to an RDS instance in the same account. It is an expensive circuit that solves a different problem.