Exam AWS Certified Solutions Architect - Associate SAA-C02 topic 1 question 488 discussion

My thought process for why it should be Option B, not Option C: You can assign security groups specifically to the Lambda, and since for security groups, the source / destination can be set specifically to another Security Group (either itself or another in the same VPC), this will limit the access ONLY to that Lambda, not to all compute resources that share the CIDR block. With Option C, since a CIDR block is whitelisted and there may be other compute resources in the compute resource subnet, this would mean that they would also get access - which doesn't sound like the "MOST SECURE" way. Any thoughts?

Looks like the answer is C: https://aws.amazon.com/blogs/aws/new-access-resources-in-a-vpc-from-your-lambda-functions/ Your Lambda functions can now access Amazon Redshift data warehouses, Amazon ElastiCache clusters, Amazon Relational Database Service (RDS) instances, and service endpoints that are accessible only from within a particular VPC. In order to do this, you simply select one of your VPCs and identify the relevant subnets and security groups. Lambda uses this information to set up elastic network interfaces (ENIs) and private IP addresses (drawn from the subnet or subnets that you specified) so that your Lambda function has access to resources in the VPC. Accessing Resources in a VPC You can set this up when you create a new function. You can also update an existing function so that it has VPC access. You can configure this feature from the Lambda Console or from the CLI. Here’s how you set it up from the Console:

You can call the LAM-SG ID to allow in DB-SG...

I choose B

"All subnets within a VPC contain a local route by default. The destination is the VPC's Classless Inter-Domain Routing (CIDR) and the target is local. For more information... ...For instances in different security groups—make sure that both security groups allow access to one another." https://aws.amazon.com/premiumsupport/knowledge-center/connect-lambda-to-an-rds-instance/

Akba09, you are right, allowing entire compute subnet will not be secured as per requirement. Current requirement is to allow Lamda to access database, hence B should be fine

Answer is B. I would always prefer rules with security groups over CIDRs. https://aws.amazon.com/blogs/aws/new-access-resources-in-a-vpc-from-your-lambda-functions/

I'll go with C

I will go with Option C : Authorize the compute subnets CIDR ranges in the database's security group Because, we need to ,make sure that For the Lambda function's security group, that traffic is allowed to go in and out of the CIDR of the RDS instance's VPC.