Which combination of steps should the developer take to diagnose this issue?
(Choose two.)
Check that the function’s security group has outbound access on port 1433 to the DB instance’s security group. Check that the DB instance’s security group has inbound access on port 1433 from the function’s security group.
Check that the function’s security group has inbound access on port 1433 from the DB instance’s security group. Check that the DB instance’s security group has outbound access on port 1433 to the function’s security group.
Check that the VPC is set up for a NAT gateway. Check that the DB instance has the public access option turned on.
Check that the function’s execution role permissions include rds:DescribeDBInstances, rds:ModifyDBInstance. and rds:DescribeDBSecurityGroups for the DB instance.
Check that the function’s execution role permissions include ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, and ec2:DeleteNetworkInterface.
Explanations:
The security group associated with the Lambda function must allow outbound traffic on port 1433 to the RDS instance’s security group. Similarly, the RDS instance’s security group must permit inbound traffic on port 1433 from the Lambda function’s security group to establish a successful connection.
The Lambda function does not need inbound access from the RDS instance’s security group on port 1433 since it initiates the connection, and RDS does not need to allow outbound access to the Lambda function. Thus, this option is not relevant for troubleshooting the connection.
A NAT gateway is not necessary for this scenario since the Lambda function is accessing a database within a VPC (private subnet) without needing to connect to the internet. Additionally, the DB instance does not require the public access option to be turned on when accessed from within the same VPC.
While the execution role permissions can be important for managing database instances and security groups, they are not directly related to establishing a connection from the Lambda function to the RDS instance. The error is likely not due to permission issues in this context.
The Lambda function needs the appropriate execution role permissions to manage network interfaces since it operates within a VPC. Permissions such asec2:CreateNetworkInterface,ec2:DescribeNetworkInterfaces, andec2:DeleteNetworkInterfaceare required for the Lambda function to create and manage the necessary network interfaces for VPC communication.
I rate that the answer is:
Check that the function’s security group has outbound access on port 1433 to the DB instance’s security group. Check that the DB instance’s security group has inbound access on port 1433 from the function’s security group.