An external database accepts connections only from registered source IP addresses.
A scheduled Lambda ingestion job should not require updating the allowlist for a changing public IP on every invocation.
Which network design is most appropriate?
Route outbound traffic from a VPC-connected Lambda function through a NAT Gateway with an Elastic IP and register that address with the external source.
Detailed explanation
The external source sees a stable NAT Elastic IP while the function remains off the public internet; use an AZ-aware design when availability matters.
The external source sees a stable NAT Elastic IP while the function remains off the public internet; use an AZ-aware design when availability matters.
Lambda execution addresses are not a stable source address, creating race conditions and ongoing allowlist work.
Lambda execution addresses are not a stable source address, creating race conditions and ongoing allowlist work.
A security group filters traffic but does not determine the public source address observed by an external database.
A security group filters traffic but does not determine the public source address observed by an external database.
An S3 Gateway Endpoint is a private path to S3, not a fixed egress address for an arbitrary external database.
An S3 Gateway Endpoint is a private path to S3, not a fixed egress address for an arbitrary external database.
Check official documentation
Compare the following points with the official documentation.
LambdaのVPCインターネット接続、NAT Gateway、Elastic IP、プライベートサブネットの公式説明を確認する。
Official references
What to confirm
セキュリティグループやS3エンドポイントと、固定送信元IPを提供するNAT Gatewayの役割を区別できる。
Key points
- IP allowlist
- NAT Gateway
- Elastic IP
- Private subnet
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm the relevant DEA-C01 Skill and current AWS service documentation.
Foundation review
Egress
Concentrate outbound traffic at a controlled, observable boundary.
Availability
Use an AZ-aware NAT design when the ingestion path must continue through an AZ failure.