A company runs an Amazon Aurora database in a VPC with no internet access and private DNS hostnames enabled. A security engineer configured AWS Secrets Manager to automatically rotate the database credentials by using the default AWS Lambda rotation function in the same VPC. Rotation fails because the Lambda function cannot reach the Secrets Manager endpoint. What is the most secure way to allow the Lambda function to communicate with Secrets Manager?

The most secure way to allow the Lambda function to communicate with Secrets Manager in a private VPC is by using an interface VPC endpoint (AWS PrivateLink). This creates a private connection to Secrets Manager within the VPC, allowing the Lambda function to access the service without traversing the public internet. Adding a NAT gateway or an internet gateway would expose the VPC to the internet, which is less secure and contradicts the requirement of no internet access. A gateway VPC endpoint is only available for Amazon S3 and DynamoDB, not for Secrets Manager.