A Lambda function configured to run in a VPC must connect to an RDS for SQL Server instance in a private subnet on port 1433, but the function fails to connect. Which steps should you take to debug the connectivity issue? (Choose two.)

When a Lambda function runs in a VPC, it needs appropriate network and IAM permissions to connect to resources like an RDS instance. The first correct option addresses network connectivity. Security groups act as virtual firewalls. The Lambda function (client) needs an outbound rule allowing traffic on port 1433 to the RDS instance's security group, and the RDS instance (server) needs an inbound rule allowing traffic on port 1433 from the Lambda function's security group. The incorrect security group option reverses these roles, which would prevent the connection. The second correct option addresses IAM permissions. For a Lambda function to connect to resources within a VPC, AWS Lambda creates and manages an Elastic Network Interface (ENI) in your VPC. The Lambda function's execution role must have the ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, and ec2:DeleteNetworkInterface permissions to allow Lambda to manage these ENIs. The option about a NAT gateway and public access is incorrect because the RDS instance is in a private subnet, and the Lambda function is connecting directly within the VPC, not over the internet. The option about rds:DescribeDBInstances permissions is incorrect because these are for managing the RDS instance itself, not for establishing a database connection.