Question

A healthcare company deploys a SageMaker real-time endpoint that serves predictions to an internal application running in a private VPC. Compliance policy prohibits any inference traffic from traversing the public internet. The ML engineer must configure the endpoint so that the application can invoke it entirely over the AWS private network. What is the most appropriate approach?

Accepted Answer

Create an interface VPC endpoint (AWS PrivateLink) for the runtime.sagemaker service and invoke the endpoint through it

Answer

Deploy the SageMaker endpoint inside the private VPC subnets by specifying the VpcConfig, then rely on the default public endpoint URL

Answer

Attach a NAT gateway to the private subnet so the application can reach the SageMaker public API over the internet securely

Answer

Enable network isolation on the model container so all traffic is forced through the VPC automatically