A developer is migrating features from a legacy monolith to AWS Lambda. The application data resides in an Amazon Aurora DB cluster in private subnets of a VPC. The account has one VPC; the Lambda functions and the DB cluster are in the same AWS Region and account. The Lambda functions must access the DB cluster securely without traversing the public internet. Which configuration satisfies this requirement?

Configuring the Lambda functions to run within the same VPC as the Aurora DB cluster, by specifying the VPC, appropriate subnets, and a security group, allows them to access the database securely via private IP addresses. This ensures traffic remains within the AWS network and does not traverse the public internet, meeting the security requirement. Setting the DB cluster's public access to "Yes" would expose the database to the internet, violating the security requirement. An Amazon RDS Proxy is beneficial for managing database connections and scaling, but it doesn't inherently solve the private connectivity requirement; the Lambda still needs VPC access to reach the proxy privately. Deploying a NAT Gateway is used for resources in private subnets to access the internet, not for Lambda functions to access resources within the same VPC privately.