A Lambda function must connect to an Amazon RDS DB instance that resides in a private subnet within a VPC. The company created an IAM role with the required DB permissions and attached it to the Lambda function. What additional configuration is required so the Lambda function can access the DB instance?

For a Lambda function to access resources within a private VPC subnet, it must be configured to run within that VPC. This places the Lambda function's elastic network interfaces (ENIs) directly into the specified subnets. Subsequently, security group rules must be updated to allow outbound traffic from the Lambda function's security group to the DB instance's security group on the appropriate port (e.g., 3306 for MySQL). Assigning a public IP to the DB instance is incorrect because it exposes the database to the internet, which is not desired for a private subnet resource and doesn't solve the Lambda's private access issue. AWS Direct Connect is for establishing private connections between on-premises networks and AWS, not for connecting Lambda functions to resources within the same VPC. Fronting the DB with CloudFront is incorrect; CloudFront is a content delivery network (CDN) and is not used for direct database connectivity.