A company stores transactional data in Amazon RDS inside a private subnet. A developer created an AWS Lambda function with default settings to perform inserts, updates, and deletes on the DB instance. The Lambda must connect privately to the DB instance without using the public internet. Which combination of steps will achieve this with the LEAST operational overhead? (Choose two.)

To allow a Lambda function to connect privately to an RDS instance in a private subnet, the Lambda function must be configured to run within the same Virtual Private Cloud (VPC) as the RDS instance. This is achieved by configuring the Lambda function to run in the same subnet as the DB instance. Additionally, security groups control traffic between resources. Attaching the same security group to both the Lambda function and the DB instance, and including a self-referencing rule that allows access on the database port, enables secure communication between them. This approach avoids using the public internet and minimizes operational overhead. Turning on public access for the DB instance would expose it to the internet, violating the private connection requirement. Updating the security group of the DB instance to allow only Lambda function invocations is insufficient; the Lambda itself needs to be in the VPC. Updating the network ACL is generally not required for intra-VPC communication when security groups are properly configured and adds unnecessary complexity.