Question

A healthcare company trains an ML model in Amazon SageMaker using sensitive patient data stored in Amazon S3. The security team requires that the training containers have no ability to make outbound calls to the public internet, ensuring the training code cannot exfiltrate data to external endpoints. Which SageMaker configuration best meets this requirement?

Accepted Answer

Enable network isolation mode on the SageMaker training job

Answer

Enable server-side encryption with AWS KMS on the S3 bucket holding the training data

Answer

Attach an IAM policy that grants the training role read-only access to S3

Answer

Enable SageMaker Debugger to monitor tensors during training