Question

A healthcare company runs SageMaker training jobs that process protected health information (PHI). Security auditors require that all inter-node communication during distributed training be encrypted, that model artifacts and training data at rest be encrypted with a customer managed key, and that no training traffic traverse the public internet. The ML engineer has already configured a private VPC with no internet gateway. Which additional set of configurations satisfies ALL of the auditors' requirements?

Accepted Answer

Enable inter-container traffic encryption on the training job, specify a customer managed KMS key for both the training input/output and the volume, and attach VPC interface endpoints for SageMaker and S3.

Answer

Enable network isolation on the training job, rely on default SSE-S3 encryption for artifacts, and use a NAT gateway so nodes can reach the SageMaker service.

Answer

Use SageMaker managed spot training with checkpointing to S3, enable default EBS encryption, and add a security group rule allowing outbound HTTPS to 0.0.0.0/0.

Answer

Encrypt only the output model artifacts with a customer managed KMS key, enable inter-container traffic encryption, and access S3 through the public S3 endpoint over TLS.