DVA-C02 Troubleshooting and Optimization Practice Question

A developer notices that an AWS Lambda function configured with a VPC is timing out when trying to access an Amazon S3 bucket. The function has the necessary IAM permissions. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Lambda function does not have a route to the internet or a VPC endpoint for S3.

The function times out because it cannot reach S3. Since the function is in a VPC, it does not have internet access by default. To access S3, it requires either a NAT gateway/instance and an internet gateway, or a VPC endpoint for S3. Option A is incorrect because Lambda functions can be configured inside a VPC; they just need proper networking. Option B is incorrect because the question states the function has the necessary IAM permissions, so the execution role is not the issue. Option D is incorrect because security groups are stateful and typically allow outbound traffic; the more likely cause is missing routing to S3. Option C correctly identifies the missing route or endpoint.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Lambda functions cannot be configured inside a VPC.
Why it's wrong here
This is incorrect because Lambda functions can indeed be configured inside a VPC to access resources within the VPC. The issue is about routing to S3, not about whether Lambda can be in a VPC.
✗
The Lambda function's execution role lacks S3 permissions.
Why it's wrong here
While IAM permissions are fundamental for authorizing a Lambda function to perform actions like reading from or writing to S3 buckets, this option is incorrect because the problem statement implies that the necessary IAM policies are already attached to the function's execution role. The execution role grants logical access to AWS services, but it does not resolve underlying network connectivity issues that prevent the Lambda function from physically reaching the S3 service endpoints when operating within a VPC.
✓
The Lambda function does not have a route to the internet or a VPC endpoint for S3.
Why this is correct
This is correct. When a Lambda function is configured inside a VPC, it loses internet access by default. To access S3, the function needs either a VPC endpoint for S3 or a route to the internet via a NAT Gateway/Instance. Without this, the function times out.
✗
The security group attached to the Lambda function does not allow outbound traffic to S3.
Why it's wrong here
This is incorrect because security groups control traffic based on IP addresses, but S3 is accessed via DNS names and IPs may change. The real issue is the lack of a route to S3, not outbound traffic restrictions. Security groups allow outbound traffic by default, so unless explicitly blocked, it is not the cause.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DVA-C02 Troubleshooting and Optimization Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question