MLA-C01 Question 452
Select 2A machine learning team uses Amazon SageMaker to train and deploy models. The team wants to ensure that the SageMaker training jobs and endpoints are only accessible from their corporate network. Which of the following controls can they implement to restrict network access to the SageMaker resources?
- A
Use AWS Identity and Access Management (IAM) policies to restrict access to SageMaker resources based on the source IP address.
- B
Configure a VPC and attach security groups to SageMaker resources to allow traffic only from the corporate network IP range.
- C
Enable AWS WAF (Web Application Firewall) to block unauthorized IP addresses from accessing SageMaker resources.
- D
Use a SageMaker-specific service control policy (SCP) to restrict access to training jobs and endpoints based on IP addresses.
- E
Deploy SageMaker resources within a VPC and configure a VPC endpoint policy to limit access to resources from specific IP ranges.
Show answer and explanation
Correct answers: B, E
Explanation
To restrict network access to SageMaker resources, you can use a combination of VPCs, security groups, and VPC endpoint policies. Security groups can restrict traffic by source IP range, while VPC endpoint policies can further enforce access controls. IAM policies and AWS WAF are not suitable for controlling network-level access to SageMaker resources.
- A. Incorrect.
IAM policies cannot restrict network access based on IP addresses directly for SageMaker resources. Network-level restrictions are typically implemented using VPCs, security groups, or endpoint policies.
- B. Correct.
Configuring a VPC and attaching security groups to SageMaker resources is a valid way to control network access. Security groups can be set to allow traffic only from specific IP ranges, such as the corporate network.
- C. Incorrect.
AWS WAF is designed to protect web applications and APIs, not to control network access to SageMaker resources. It is not applicable in this scenario.
- D. Incorrect.
There is no SageMaker-specific SCP that allows restriction based on IP addresses. SCPs are used to manage permissions across AWS Organizations and do not offer network-level controls.
- E. Correct.
Deploying SageMaker resources within a VPC and configuring a VPC endpoint policy to restrict access to specific IP ranges is a recommended approach for controlling network access.