Question

A financial services company runs a Lambda function inside private subnets of a VPC. The function must retrieve database credentials stored in AWS Secrets Manager. For compliance reasons, the VPC has no internet gateway and no NAT gateway, so no traffic may traverse the public internet. Currently the Lambda invocations time out when calling the Secrets Manager API. What is the MOST appropriate solution to allow secure credential retrieval?

Accepted Answer

Create an interface VPC endpoint (AWS PrivateLink) for Secrets Manager and associate it with the private subnets' security group

Answer

Deploy a NAT gateway in a public subnet so the Lambda function can reach the Secrets Manager public endpoint

Answer

Store the credentials in Lambda environment variables encrypted with a KMS key instead of using Secrets Manager

Answer

Create a gateway VPC endpoint for Secrets Manager and add a route to the private subnet route table