AWS Certified AI PractitionerAWS Services for AI/ML and Generative AIMedium
A global e-commerce company uses Amazon SageMaker to train its machine learning models. Due to strict data residency regulations in certain regions, all training data and model artifacts must never leave the AWS region where the training is performed. Additionally, the company wants to ensure that all communication between SageMaker and other AWS services, such as Amazon S3 for data storage, occurs over private networks without traversing the public internet. Which security measure should the company implement to meet these requirements?
- AEnable VPC Flow Logs for all SageMaker-related VPCs.
- BUse S3 bucket policies to restrict access to specific IP ranges.
- CEncrypt all data at rest and in transit using AWS Key Management Service (KMS).
- DConfigure VPC interface endpoints (AWS PrivateLink) for SageMaker and S3.
Show answer & explanationAnswer & explanation
Correct answer: D. Configure VPC interface endpoints (AWS PrivateLink) for SageMaker and S3.
VPC interface endpoints (AWS PrivateLink) allow you to privately connect your VPC to supported AWS services like Amazon SageMaker and Amazon S3 without exposing your traffic to the public internet, ensuring data residency and private communication.
Why the other options are wrong
- A. VPC Flow Logs capture IP traffic information but do not prevent traffic from traversing the public internet; they are for monitoring, not enforcement.
- B. S3 bucket policies can control access but do not guarantee private network communication or prevent data from potentially traversing the public internet.
- C. Encryption is crucial for data security but does not, by itself, ensure that data traffic remains on private networks or within a specific region's private network boundary.
AWS PrivateLink (VPC Interface Endpoints)
A technology that enables private connectivity between VPCs and services hosted on AWS, without exposing data to the public internet.
- Keeps network traffic within the AWS network
- Enhances security and compliance for sensitive data
- Supports various AWS services and partner services
Memory trick: PrivateLink: A 'private link' for your VPC to AWS services, no public internet allowed.