A company runs an Amazon RDS for MySQL DB instance in a VPC that must not send or receive traffic over the public internet. Due to policy restrictions, the company cannot use the default AWS Lambda rotation function that AWS Secrets Manager provides, so a custom Lambda function was deployed in the VPC to rotate the secret. The DB instance’s security group allows connections from this function. However, when invoked, the function cannot reach Secrets Manager to complete rotation. What should the security engineer do to enable the function to rotate the secret?

The correct solution is to create an AWS Secrets Manager interface VPC endpoint (AWS PrivateLink) and include the Lambda function’s private subnet. This allows the Lambda function, which is in a private subnet with no internet access, to communicate directly with the Secrets Manager service within the AWS network without traversing the public internet. This satisfies the policy restriction of not sending or receiving traffic over the public internet. Adding an egress-only internet gateway is for IPv6 traffic and would not resolve the issue for a Lambda function needing to reach a public AWS service over IPv4. Adding a NAT gateway would provide outbound internet access, which violates the policy restriction against public internet traffic. Creating a VPC peering connection to the default VPC for Secrets Manager is not a valid or secure way to access AWS services; AWS services are accessed via public endpoints or private endpoints (PrivateLink), not by peering with a "default VPC for Secrets Manager.