Question

A healthcare company deploys a SageMaker real-time endpoint that processes protected health information. Compliance requires that the inference container must not be able to make any outbound network calls (including to the internet or third-party APIs), while the endpoint itself must still be reachable by the company's internal applications running in a private VPC. Which configuration meets both requirements?

Accepted Answer

Enable network isolation on the model, and configure the endpoint with the company's VPC subnets and security groups plus a VPC interface endpoint for SageMaker runtime.

Answer

Deploy the endpoint without VPC configuration but attach an IAM policy that denies all outbound traffic from the container.

Answer

Enable network isolation only, relying on it to both block container egress and route internal application traffic privately.

Answer

Configure the endpoint in the VPC with a NAT gateway so the container can reach approved services while internal apps connect privately.