Question

A healthcare company runs an application on Amazon EC2 instances inside a private VPC subnet. The application calls Amazon Bedrock for inference on patient-related data. Compliance requires that this inference traffic must NOT traverse the public internet at any point. Which approach meets this requirement?

Accepted Answer

Create an AWS PrivateLink (VPC interface endpoint) for Amazon Bedrock so requests stay within the AWS network

Answer

Attach an internet gateway to the VPC and restrict outbound traffic with a security group

Answer

Enable server-side encryption with AWS KMS on the Bedrock requests

Answer

Route the Bedrock API calls through a NAT gateway in a public subnet