MLS-C01 Question 346
Select 2You are building a machine learning inference application on Amazon SageMaker. The application needs to communicate with an Amazon EC2 instance hosting a database. Both resources are in the same VPC. For security purposes, you must ensure that only the SageMaker endpoint can access the database on the EC2 instance. Which configuration should you implement?
- A
Configure a security group on the EC2 instance with an inbound rule allowing traffic from the SageMaker endpoint's security group.
- B
Configure a security group on the SageMaker endpoint with an outbound rule allowing traffic to the EC2 instance's security group.
- C
Configure a security group on the EC2 instance with an inbound rule allowing traffic from the CIDR block of the VPC.
- D
Configure both the EC2 instance and the SageMaker endpoint to use the same security group.
- E
Configure a Network ACL to allow traffic from the SageMaker endpoint's IP address to the EC2 instance.
Show answer and explanation
Correct answers: A, B
Explanation
To securely enable communication between the SageMaker endpoint and the EC2 instance, you should configure security groups on both resources. The EC2 instance's security group should allow inbound traffic from the SageMaker endpoint's security group, and the SageMaker endpoint's security group should allow outbound traffic to the EC2 instance's security group. This ensures tight access control while adhering to AWS security best practices.
- A. Correct.
This is the correct approach because security groups act as virtual firewalls, and specifying the SageMaker endpoint's security group in the EC2 instance's inbound rule ensures only traffic from SageMaker is allowed.
- B. Correct.
This is correct because the outbound rule on the SageMaker endpoint's security group ensures that traffic can reach the EC2 instance's security group.
- C. Incorrect.
This is incorrect because allowing traffic from the entire VPC CIDR block is overly permissive and does not restrict access to just the SageMaker endpoint.
- D. Incorrect.
This is incorrect because using the same security group does not provide the granularity needed to control traffic between the resources.
- E. Incorrect.
This is incorrect because while Network ACLs can control traffic, they are stateless and less commonly used for resource-specific access control compared to security groups.