MLA-C01 Question 448
Select 3You are designing a machine learning workflow on AWS that involves training and hosting models in Amazon SageMaker. Your organization requires strict control over network access to ML resources to ensure compliance with security policies. Which combination of actions should you take to restrict network access to the SageMaker training and hosting endpoints?
- A
Configure a VPC endpoint for Amazon SageMaker to route traffic securely within your VPC.
- B
Use AWS Identity and Access Management (IAM) policies to restrict access to SageMaker resources based on user roles.
- C
Enable network ACLs to block inbound and outbound traffic to the SageMaker public endpoints.
- D
Attach security groups to SageMaker resources to control inbound and outbound traffic.
- E
Disable internet access for SageMaker notebook instances and enable private subnet routing for communication.
Show answer and explanation
Correct answers: A, D, E
Explanation
Restricting network access to SageMaker resources involves multiple layers of control, including configuring VPC endpoints to ensure traffic stays within your private network, using security groups for fine-grained traffic control, and disabling internet access for notebook instances to prevent unintended exposure. These actions collectively enhance the security posture of your ML resources. IAM policies, while crucial for user-level permissions, do not directly impact network-level access control, and network ACLs are too broad to serve this specific purpose.
- A. Correct.
Configuring a VPC endpoint for Amazon SageMaker ensures that network traffic between your VPC and SageMaker is routed securely without traversing the public internet. This is a key step in restricting network access to ML resources.
- B. Incorrect.
While IAM policies are essential for managing user permissions, they do not control network-level access to SageMaker resources. Therefore, this is not relevant to the question.
- C. Incorrect.
Network ACLs are not directly used to restrict access to SageMaker endpoints. They are general-purpose tools for controlling traffic at the subnet level but are not specific to SageMaker.
- D. Correct.
Attaching security groups to SageMaker resources allows you to enforce fine-grained control over inbound and outbound traffic, making it an important step for network access control.
- E. Correct.
Disabling internet access for SageMaker notebook instances and routing traffic through a private subnet ensures that your resources remain isolated from the public internet, meeting compliance and security requirements.