You need a Lambda function to securely query an Amazon Aurora database that resides in a private subnet of VPC1. Which configuration will allow the Lambda function to access the database securely?

The correct approach is to configure the Lambda function for VPC access within VPC1. By attaching the same security group (SG1) to both the Lambda function and the Aurora database, and configuring SG1 to allow inbound TCP traffic on port 3306 (the default for MySQL/Aurora), you establish secure communication within the private subnet. This allows the Lambda to initiate connections to the database. Creating the Lambda in a new public subnet in VPC2 and peering with VPC1 is overly complex and introduces unnecessary public exposure. Attaching different security groups (SG1 to Lambda, SG2 to database) and adding an inbound rule to SG1 for port 3306 is incorrect; the inbound rule needs to be on the database's security group, allowing traffic from the Lambda's security group. Exporting data to S3 and querying from there is not a direct database query and changes the fundamental requirement.