An application’s database was moved from a public subnet that used a public endpoint into a private subnet to remove public network access. After this change, an AWS Lambda function that needs read access can no longer reach the database. The administrator must restore connectivity without opening the database to the public internet. Which approach satisfies this requirement?

The correct approach is to create an AWS PrivateLink interface endpoint for the Lambda function and connect to the database using its private endpoint. AWS PrivateLink allows private connectivity between VPCs and AWS services without exposing traffic to the public internet. By creating an interface endpoint for the database service (e.g., RDS) within the Lambda function's VPC, the Lambda function can securely and privately access the database in the private subnet. Connecting the Lambda function to the database VPC is insufficient on its own; PrivateLink or VPC peering would still be needed for cross-VPC communication, and the question implies the Lambda is not in the same VPC. Attaching an IAM role provides authorization, not network connectivity. Moving the database to a public subnet defeats the purpose of removing public network access.