A company uses default settings to create an AWS Lambda function.

By default, a newly created AWS Lambda function is not attached to a customer VPC. In its default configuration, Lambda runs in an AWS-managed network environment and can reach public internet endpoints, but it does not automatically have network-level connectivity into private subnets within a VPC. Accessing an Amazon RDS instance that is placed in a private subnet requires the Lambda function to be configured for VPC access. This means selecting the target VPC, choosing subnets (typically private subnets with appropriate routing), and associating one or more security groups with the Lambda function’s elastic network interfaces (ENIs). Once configured, Lambda creates ENIs in the selected subnets and uses them to communicate with resources such as RDS inside the VPC.

In this scenario, the RDS database is in a private subnet and is reachable from within the VPC, but the Lambda function cannot connect. The most likely cause is that the function was created with default settings and therefore was not deployed into the VPC that contains the database. IAM permissions are not sufficient for network connectivity; IAM controls authorization to call AWS APIs, while VPC attachment and security groups control the network path.

Option A is incorrect because Lambda does not require an “RDS destination” setting; connectivity is established through VPC networking and the database endpoint. Option C is not supported by the prompt; there is no indication that the database is in a different VPC, and the default issue is usually “not in a VPC at all.” Option D is less likely because Lambda security groups allow all outbound traffic by default unless explicitly restricted; the more common default failure is lack of VPC configuration.

Therefore, the likely reason is that the Lambda function was not configured to run in the same VPC as the RDS instance.