Question

A healthcare company runs a real-time SageMaker inference endpoint that processes patient data. Their security team requires that all traffic from application servers (running in a private VPC subnet) to the SageMaker Runtime API must never traverse the public internet, and no internet gateway or NAT device should be involved in these calls. What is the correct way to meet this requirement?

Accepted Answer

Create an interface VPC endpoint (AWS PrivateLink) for the com.amazonaws.<region>.sagemaker.runtime service and route application traffic through it.

Answer

Attach a NAT gateway to the private subnet so the application servers can reach the SageMaker Runtime endpoint securely.

Answer

Create a gateway VPC endpoint for SageMaker Runtime and add it to the subnet route table.

Answer

Enable network isolation on the SageMaker model so all inference requests stay inside the VPC automatically.