AWS Certified AI PractitionerAWS Services for AI/ML and Generative AIHard
A company is using Amazon SageMaker to train sensitive machine learning models. To prevent data exfiltration and ensure that training data and model artifacts are only accessible from authorized private networks, they need to restrict network access to SageMaker resources. Which AWS networking construct should they primarily use to achieve this isolation?
- ANAT Gateway
- BInternet Gateway
- CAWS Direct Connect
- DVPC endpoints (interface endpoints)
Show answer & explanationAnswer & explanation
Correct answer: D. VPC endpoints (interface endpoints)
VPC interface endpoints (powered by AWS PrivateLink) allow you to privately connect your VPC to supported AWS services, like Amazon SageMaker, without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect. This ensures that all traffic between your VPC and SageMaker remains within the Amazon network, preventing data exfiltration over the public internet.
Why the other options are wrong
- A. A NAT Gateway allows resources in a private subnet to initiate outbound connections to the internet, but doesn't allow inbound connections from the internet, nor does it provide private access to AWS services.
- B. An Internet Gateway (IGW) explicitly allows resources in a public subnet to connect to the internet, which is the opposite of the requirement for private access.
- C. AWS Direct Connect establishes a dedicated network connection from on-premises to AWS, but doesn't inherently isolate traffic *within* AWS services from the internet.
VPC Interface Endpoints (PrivateLink)
A feature that allows you to privately connect your VPC to supported AWS services and VPC endpoint services powered by AWS PrivateLink, without using an internet gateway, NAT device, VPN, or Direct Connect.
- Keeps traffic between your VPC and AWS services within the Amazon network.
- Enhances security by preventing data exposure to the public internet.
- Supports various AWS services, including Amazon SageMaker.
Memory trick: VPC Endpoints create a private tunnel, keeping data off the internet.