AWS Certified AI PractitionerAWS Services for AI/ML and Generative AIHard
A research institution is using Amazon SageMaker to train highly sensitive models involving patient genomic data. Due to strict regulatory requirements (HIPAA, GDPR), all data, model artifacts, and intermediate results must remain within the institution's private network and never traverse the public internet. Which security mechanism is crucial for ensuring this level of network isolation for SageMaker components?
- ASecurity Groups and Network Access Control Lists (NACLs)
- BAWS Key Management Service (KMS) for encryption at rest
- CVirtual Private Cloud (VPC) Interface Endpoints (AWS PrivateLink)
- DAmazon S3 bucket policies with Deny Public Access
Show answer & explanationAnswer & explanation
Correct answer: C. Virtual Private Cloud (VPC) Interface Endpoints (AWS PrivateLink)
VPC Interface Endpoints (powered by AWS PrivateLink) allow SageMaker API calls and data transfer to remain entirely within the AWS network and your VPC, without traversing the public internet. This is essential for strict data residency and compliance requirements like HIPAA and GDPR.
Why the other options are wrong
- A. Security Groups and NACLs control traffic flow within and between VPC subnets, but don't inherently prevent traffic from reaching the public internet if an endpoint isn't used.
- B. KMS provides encryption, which is necessary for data protection, but doesn't prevent data from traversing the public internet if not combined with network isolation.
- D. S3 bucket policies prevent public access to S3 data, but SageMaker might still access S3 over the public internet by default if PrivateLink is not configured for the SageMaker service itself.
VPC Interface Endpoints (PrivateLink)
A technology that allows you to privately connect your VPC to AWS services and VPC endpoint services powered by PrivateLink, without using an internet gateway, NAT device, VPN connection, or AWS Direct Connect.
- Keeps traffic entirely within the AWS network.
- Enhances security and compliance (e.g., HIPAA, GDPR).
- Uses private IP addresses for service access.
- Crucial for scenarios requiring strict network isolation.
Memory trick: PrivateLink keeps data private, never touching the public net.