How Do You Stop Lambda from Overloading a Private RDS PostgreSQL Database?
Short answer
B Point the Lambda client driver at the RDS Proxy endpoint and deploy the functions inside a VPC so connections are pooled and PostgreSQL is not overloaded.
Question
Key Takeaways
The question tests two linked facts — that only RDS Proxy pools and multiplexes Lambda connections to RDS, and that a private RDS instance is reachable only from Lambda functions attached to the VPC — and the trap is treating an RDS custom endpoint as if it performed connection pooling.
Unpredictable traffic hitting Lambda functions that talk directly to a private Amazon RDS for PostgreSQL instance can exhaust the database's connection limit. This page establishes that pointing the client driver at the RDS Proxy endpoint while deploying the Lambda functions inside a VPC (option B) is the correct design.
Common mistake: Picking a custom endpoint (options A or C) because 'custom' sounds purpose-built for this scenario; custom endpoints only route traffic to specific instances in a cluster and never pool connections, so unpredictable Lambda bursts would still overwhelm PostgreSQL's max_connections.
Expert Analysis
Why the Answer Is Correct
Each Lambda invocation or warm container opens its own database connection, so an unpredictable ecommerce traffic spike can spawn hundreds of concurrent sessions and exhaust the PostgreSQL instance's connection limit. RDS Proxy sits between the functions and the DB instance, maintaining a warm pool of connections it hands out and reuses, which keeps database performance predictable and absorbs sudden bursts without overloading the instance. The second half of option B is just as mandatory: because the DB instance is private, the functions must be deployed inside the VPC with subnets and security groups that can reach it. Community commenters converged on the same reasoning — ogerber explains that a Lambda "outside of a VPC can't access an RDS instance that's inside a VPC", and Kezuko simply states the functions have to be inside the VPC to reach the database. Option B is therefore the only choice that solves both the connection-exhaustion problem and the network-reachability problem.
Why the Other Options Are Wrong
Option A gets the VPC placement right but pairs it with an RDS custom endpoint, which exists to route traffic to particular instances in a cluster, not to pool or multiplex connections — Lambda bursts would still create unlimited sessions. Options C and D place the Lambda functions outside the VPC, which makes the private RDS instance unreachable regardless of which endpoint the driver points at, so they fail the question immediately. Option D is doubly wrong because it combines the incorrect endpoint type with the incorrect network placement. Custom endpoints also are not the mechanism that delivers predictable database performance under spiky, unpredictable invocation patterns; only a connection proxy does that.
Community Comment Notes
Every recorded learner vote (100 total) selected option B, and the comments explain why rather than just repeating the answer. ogerber cites the AWS re:Post knowledge-center guidance and quotes that a Lambda function "outside of a VPC can't access an RDS instance that's inside a VPC", tying both halves of the answer to official documentation. Kezuko reinforces the VPC requirement in one line, and Moon239 notes this scenario repeats from SAA-C02 question 802, which signals the pattern is worth memorizing as a rule rather than a one-off. Take the consensus as a study signal, but the deciding logic remains RDS Proxy for pooling plus in-VPC Lambda for reachability.
Official Reference
- https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.html
- https://repost.aws/knowledge-center/connect-lambda-to-an-rds-instance
These links open the official vendor documentation in a new tab.
Exam Strategy
When a question pairs Lambda (or any bursty, serverless compute) with a relational database and mentions too many connections, unpredictable traffic, or predictable performance, RDS Proxy is almost always the intended answer. Then verify the placement half of the option: a private RDS instance can only be reached from inside its VPC, so reject any choice that leaves the functions outside the VPC.
Frequently Asked Questions
Why doesn't an RDS custom endpoint fix Lambda connection exhaustion?
Why must the Lambda functions be inside a VPC in this scenario?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
ogerber 👍 10 Answered BOption B. Reduce number of connection to RDS -> RDS Proxy. "A Lambda function that's outside of a VPC can't access an RDS instance that's inside a VPC." https://repost.aws/knowledge-center/connect-lambda-to-an-rds-instance
-
Kezuko 👍 5 Answered BHave to be inside VPC in order to access the RDS instance for Lambda
-
Moon239 👍 3Same as question 802 in SAA-C02
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SAA-C03 Questions
Access 120 questions with complete answers and detailed explanations.
View Full SAA-C03 Practice Test →