A scheduled Lambda function currently runs without VPC access and fetches datasets from the internet. The application will be changed so the Lambda must write to an RDS DB instance located in a private subnet. The VPC has two public and two private subnets. What configuration allows the Lambda to reach the private DB and still access the internet?

The correct solution enables the Lambda to connect to the private RDS instance and access the internet. Placing the Lambda in private subnets allows direct communication with the RDS database. NAT Gateways in public subnets provide a path for outbound internet access from the private subnets without exposing the Lambda directly to the internet. Configuring private route tables to route 0.0.0.0/0 through the NAT Gateways ensures all internet-bound traffic from the private subnets uses the NAT Gateway. A security group on the Lambda with outbound access allows it to initiate connections. Incorrect options: Attaching the Lambda to public subnets would expose it to the internet and prevent direct private communication with the RDS instance. Elastic IPs are for EC2 instances, not directly for Lambda functions. Assigning public IP addresses to a Lambda in public subnets would also expose it and not facilitate private DB access. Routing internet-bound traffic directly to an internet gateway from private subnets is not possible; private subnets require a NAT Gateway or similar service for outbound internet access.