Question

A healthcare company runs SageMaker training jobs inside a private VPC subnet with no internet gateway and no NAT gateway, per compliance policy. Training data is stored in Amazon S3. When engineers launch a training job configured with the VPC subnets and security groups, the job fails during startup because it cannot download the training data from S3. The company must keep all traffic off the public internet. What is the MOST cost-effective way to allow the training job to access S3?

Accepted Answer

Create an S3 gateway VPC endpoint and associate it with the route table for the training subnets.

Answer

Add a NAT gateway to the VPC so the training instances can reach the S3 public endpoint.

Answer

Create an interface VPC endpoint (AWS PrivateLink) for Amazon S3 in each training subnet.

Answer

Attach an internet gateway and restrict outbound traffic with a security group that only allows the S3 CIDR ranges.