MLS-C01 Question 347
Select 2You are deploying a machine learning model on an Amazon SageMaker endpoint, which needs to communicate securely with a feature store hosted on an Amazon RDS instance. Both resources are in the same VPC, and you need to ensure that only the SageMaker endpoint can connect to the RDS instance. How should you configure the security groups to meet this requirement?
- A
Attach a security group to the RDS instance that allows inbound traffic on the RDS port (e.g., 3306) only from the security group attached to the SageMaker endpoint.
- B
Configure the SageMaker security group to allow outbound traffic to the RDS security group on the RDS port (e.g., 3306).
- C
Set the RDS security group to allow inbound traffic from any source on the RDS port (e.g., 3306).
- D
Attach the same security group to both the SageMaker endpoint and the RDS instance to enable unrestricted communication between them.
- E
Use a Network ACL to explicitly deny all traffic except between the SageMaker endpoint and the RDS instance.
Show answer and explanation
Correct answers: A, B
Explanation
To securely enable communication between the SageMaker endpoint and the RDS instance, you need to configure the security groups to allow traffic only from the SageMaker endpoint to the RDS instance on the required port. Specifically, the RDS security group should allow inbound traffic from the SageMaker security group, and the SageMaker security group should allow outbound traffic to the RDS security group. This setup adheres to the principle of least privilege and ensures that no unauthorized access is allowed.
- A. Correct.
Correct. This ensures that only traffic from the SageMaker endpoint's security group is allowed to connect to the RDS instance on the specified port, following the principle of least privilege.
- B. Correct.
Correct. Outbound rules in the SageMaker security group must explicitly allow traffic to the RDS security group on the required port for communication to succeed.
- C. Incorrect.
Incorrect. Allowing inbound traffic from any source would leave the RDS instance vulnerable to unauthorized access, violating security best practices.
- D. Incorrect.
Incorrect. Attaching the same security group to both resources would not restrict communication to just the SageMaker endpoint, as it would allow traffic from any resource using that security group.
- E. Incorrect.
Incorrect. While Network ACLs can be used for additional security, they are not required in this scenario. Security groups are sufficient to control traffic between the SageMaker endpoint and the RDS instance.