AWS Certified Machine Learning – SpecialtyMachine Learning Implementation and OperationsMedium
A healthcare provider is deploying a diagnostic ML model that processes sensitive patient data. Due to strict regulatory compliance (e.g., HIPAA), they must ensure that all inference requests and responses to and from the SageMaker endpoint are fully encrypted in transit. Which mechanism should be configured to meet this security requirement?
- AConfigure the SageMaker endpoint to use HTTPS/TLS.
- BEnable data capture for the endpoint to S3 with KMS encryption.
- CUse SageMaker Clarify to analyze data for bias and explainability.
- DEncrypt the model artifacts stored in S3 with KMS.
Show answer & explanationAnswer & explanation
Correct answer: A. Configure the SageMaker endpoint to use HTTPS/TLS.
To ensure data is encrypted in transit between a client and a SageMaker endpoint, HTTPS/TLS encryption is the standard mechanism. SageMaker endpoints automatically enforce HTTPS for all communications, ensuring that inference requests and responses are encrypted while traveling over the network, which is critical for sensitive data and compliance.
Why the other options are wrong
- B. Enabling data capture with KMS encryption secures data at rest in S3 after it has been captured, but does not encrypt data in transit.
- C. SageMaker Clarify is used for bias detection and explainability, not for encrypting data in transit.
- D. Encrypting model artifacts in S3 protects the model at rest, not the inference requests and responses during transit.
SageMaker Endpoint In-transit Encryption
The mechanism by which data sent to and from a SageMaker endpoint is secured while traveling over the network, primarily achieved through HTTPS/TLS.
- SageMaker endpoints automatically enforce HTTPS.
- HTTPS/TLS encrypts data between client and endpoint.
- Crucial for sensitive data and regulatory compliance (e.g., HIPAA, GDPR).
- Protects inference requests and responses.
Memory trick: HTTPS is the secure tunnel for your data's journey.