Question

A healthcare company runs SageMaker real-time endpoints inside a VPC with no internet access. They want to enable SageMaker Model Monitor to run scheduled data quality monitoring jobs against captured inference data stored in S3. During testing, the monitoring jobs remain stuck in a pending state and eventually fail to reach S3 and the SageMaker service. What is the MOST likely cause and correct remediation?

Accepted Answer

The monitoring job's networking configuration lacks VPC settings with subnets, security groups, and required VPC endpoints for S3 and SageMaker; configure the MonitoringJobDefinition NetworkConfig with the VPC and add gateway/interface endpoints.

Answer

Model Monitor cannot run inside a VPC; disable network isolation and route the monitoring jobs through a public subnet with an internet gateway.

Answer

The captured data must be stored in EFS rather than S3 for Model Monitor to access it within a VPC; migrate the data capture destination to an EFS mount.

Answer

Model Monitor requires the endpoint's KMS key to be disabled during monitoring; remove encryption from the data capture bucket to allow the job to read it.