Skip to content

Study Notes: MLA_C01 Task 4.3 – Secure AWS Resources

Task Overview

This task focuses on applying security controls across the ML lifecycle on AWS. You must protect people, tools, pipelines, data, models, and compute using the principle of least privilege, network isolation, encryption, auditing, and compliance features. Security is a foundational design decision (not an afterthought) and maps directly to the AWS Shared Responsibility Model, Well-Architected Framework Security Pillar, and SageMaker-specific controls.

Core knowledge areas

  • IAM identities (users/groups/roles), identity-based vs resource-based policies, condition keys, SageMaker execution roles, and SageMaker Role Manager.
  • Network isolation: VPCs, private subnets, security groups, VPC endpoints (interface + gateway), disabling direct internet access for Studio/notebooks/training/hosting.
  • Data protection: encryption at rest (KMS for S3/EFS/EBS/Studio), encryption in transit (TLS + inter-node encryption for distributed training), S3 versioning + MFA Delete.
  • Monitoring/auditing: CloudTrail, CloudWatch, GuardDuty, VPC Flow Logs, SageMaker logging; compliance via AWS Artifact.
  • CI/CD and artifact security, root-access controls on notebooks, and troubleshooting access denials.

Core skills

  • Building least-privilege IAM policies/roles for humans and SageMaker services.
  • Isolating ML resources in private VPCs with controlled egress.
  • Enabling encryption, versioning, and logging.
  • Diagnosing and fixing “AccessDenied” or connectivity issues.

Key Concepts (Exam-Ready Summary)

Area Must-Know Points
Accounts & IAM Fundamentals Root user locked down (MFA, no access keys). Identities start with zero permissions. Prefer roles over long-lived users. Identity-based policies (attached to principal) vs resource-based (attached to S3 bucket, KMS key, etc.).
SageMaker Execution Role SageMaker assumes this role to call other services (S3, ECR, CloudWatch, KMS…). Use SageMaker Role Manager to generate least-privilege roles for Studio users, training jobs, endpoints, etc.
Network Controls Launch Studio domain / notebook / training / endpoint inside VPC (private subnets preferred). Disable direct internet. Use Interface VPC endpoints (SageMaker API, Runtime, Studio) + S3 Gateway endpoint so traffic never leaves AWS network. Restrict with endpoint policies + IAM conditions (aws:SourceVpce, aws:SourceIp). Security groups as stateful firewalls. NAT Gateway only when outbound internet is truly required.
Notebook / Studio Hardening Default root access on classic notebooks → disable via IAM or lifecycle config for shared/sensitive notebooks. Studio uses EFS + container isolation + file-system permissions.
Data Security SSE-S3 or SSE-KMS on buckets holding models/data. KMS CMKs for Studio EFS, notebook EBS, training jobs. Enable S3 versioning + MFA Delete. Inter-container traffic encryption for distributed training (EnableInterContainerTrafficEncryption=true).
Audit & Compliance CloudTrail (all API calls), CloudWatch Logs/Metrics/Alarms, GuardDuty, AWS Config, Artifact for compliance reports (HIPAA, FedRAMP…).
CI/CD Least-privilege roles for CodePipeline/CodeBuild; rotate credentials; protect model registry and artifact buckets.

Exam Tips & Common Traps

Tips

  • Always start with “what is the least privilege needed?” – Role Manager and IAM Access Analyzer are your friends.
  • Prefer VPC endpoints + private subnets over public internet or NAT when the service supports it (S3 gateway endpoint is free).
  • Distinguish identity-based vs resource-based policies; both are often required together (e.g., SageMaker role + S3 bucket policy).
  • SageMaker can encrypt inter-node traffic automatically – you do not write crypto code.
  • Root access on notebooks is convenient for data scientists but dangerous on shared or VPC-attached instances containing sensitive data.

Traps

  • Forgetting that SageMaker needs an execution role with explicit permissions to S3, ECR, KMS, Logs, etc. → “AccessDeniedException”.
  • Launching Studio/notebook with direct internet enabled “for convenience” then wondering why data exfiltration is possible.
  • Using a broad AmazonSageMakerFullAccess managed policy in production (exam loves least-privilege alternatives).
  • Assuming interface VPC endpoints are free (they are not – hourly + data processing charges). Gateway endpoints (S3/DynamoDB) are free.
  • Enabling S3 versioning but forgetting MFA Delete – objects can still be permanently deleted without MFA.
  • Mixing up security groups (instance level, stateful) vs NACLs (subnet level, stateless).
  • Thinking encryption at rest is automatic for every SageMaker storage location – you often must supply a KMS key ID.

Hands-on Exercises (Minimized Cost)

Cost-control rules applied to every exercise - Prefer free services (IAM, S3 standard, gateway endpoints, CloudTrail management events). - Create resources → test immediately → delete within the same session. - Never leave SageMaker notebook/Studio apps, NAT Gateways, Interface endpoints, or KMS CMKs running overnight. - Use the cheapest possible instance types only if absolutely required and stop/delete within minutes. - All exercises can be completed in the AWS Console; CLI/SDK optional. - Estimated cost if cleaned up promptly: < $1 (usually $0.00–0.30).

Exercise 1: Least-Privilege IAM Roles & SageMaker Role Manager + S3 Bucket Policy

Goal: Practice identity-based + resource-based policies and Role Manager (covers IAM, least privilege, SageMaker execution roles).

Steps

  1. IAM Console → Roles → Create role → AWS service → SageMaker.
  2. Skip the broad managed policies. Instead open SageMaker Role Manager (search bar) → Create role.
  3. Persona: Data Scientist (or custom).
  4. ML activities: select only “Access S3 buckets”, “Log to CloudWatch”, “Retrieve ECR images” (uncheck everything else).
  5. S3 buckets: create/select a test bucket ml-secure-artifacts-<accountid>.
  6. Generate and create the role. Note the role ARN.
  7. S3 Console → create bucket ml-secure-artifacts-<accountid> (same Region, block all public access).

  8. Bucket → Permissions → Bucket policy → add a resource-based policy that allows only the role created above: json { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::ACCOUNT:role/SageMakerRoleManager-..."}, "Action": ["s3:GetObject","s3:PutObject","s3:ListBucket"], "Resource": [ "arn:aws:s3:::ml-secure-artifacts-ACCOUNT", "arn:aws:s3:::ml-secure-artifacts-ACCOUNT/*" ] }] }

  9. (Optional free test) IAM Policy Simulator → select the role → simulate s3:PutObject on the bucket (should be allowed) and on another bucket (should be denied).

  10. Cleanup: Delete the bucket (empty first), delete the IAM role and any inline policies.

Expected result

  • Role contains only the actions you selected (far narrower than AmazonSageMakerFullAccess).
  • Bucket policy rejects any principal except that role.
  • Policy Simulator confirms least privilege.

Linked exam tips/traps

  • Trap: using managed full-access policies → this exercise forces least privilege via Role Manager.
  • Tip: combination of identity-based (role) + resource-based (bucket) is frequently tested.
  • Demonstrates condition-key thinking (you can later add "Condition": {"StringEquals": {"aws:SourceVpce": "vpce-..."}}).

Exercise 2: Private VPC Isolation + S3 Gateway Endpoint + Security Groups (No Long-Running Compute)

Goal: Build network controls that securely isolate ML resources (VPC, subnets, SGs, endpoints). Covers “Building VPCs…”, network access controls, and endpoint policies.

Steps

  1. VPC Console → Create VPC → “VPC and more”
  2. Name: ml-secure-vpc
  3. 1 AZ, 1 public subnet (for bastion/NAT if needed), 1 private subnet.
  4. NAT gateways: None (saves cost).
  5. VPC endpoints: check S3 (gateway). Leave interface endpoints unchecked (they cost money).
  6. Enable DNS hostnames + DNS resolution.
  7. Create two security groups:
  8. sg-sagemaker: inbound = none (or HTTPS from itself for inter-node); outbound = HTTPS (443) to the VPC CIDR and to prefix lists if desired.
  9. sg-endpoint: inbound = HTTPS from sg-sagemaker.
  10. (Optional free hardening) Create an endpoint policy on the S3 gateway endpoint that allows access only to your ml-secure-artifacts-* bucket.
  11. Note the private subnet ID, SG IDs, and VPC ID – these are exactly the values you later supply when creating a Studio domain or notebook “VPC only” configuration.
  12. Cleanup (do immediately):
  13. Delete the S3 gateway endpoint.
  14. Delete subnets, route tables, security groups, then the VPC.
  15. Confirm no Elastic IPs or NAT Gateways exist.

Expected result

  • Private subnet has a route table whose only S3 route is the gateway endpoint target (vpce-… or pl-…).
  • No 0.0.0.0/0 IGW route in the private route table → no direct internet.
  • Security groups enforce least network privilege.
  • You now have a reusable pattern for “launch SageMaker in VPC with no internet”.

Linked exam tips/traps

  • Trap: forgetting that interface endpoints (SageMaker API, STS, Logs…) cost money while S3/DynamoDB gateway endpoints are free – exam expects you to choose gateway when possible.
  • Tip: “Disable direct internet access” + VPC endpoints keeps traffic on the AWS backbone and is a classic correct answer.
  • You practiced the exact resources (subnet IDs, SGs) required by Studio domain / notebook / training job VPC config.
  • Condition keys aws:SourceVpce and aws:SourceIp can now be added to the IAM policies from Exercise 1.

Exercise 3: Encryption, Versioning, MFA Delete, Logging & Root-Access Controls

Goal: Protect data at rest/in transit, enable auditability, and harden notebooks (covers KMS, S3 security, CloudTrail, notebook root access, compliance mindset).

Steps

  1. S3 artifact bucket hardening (use bucket from Ex. 1 or new):
  2. Properties → Default encryption → SSE-S3 (or SSE-KMS with aws/s3 – avoid customer-managed key to save the $1/month CMK charge).
  3. Properties → Bucket Versioning → Enable.
  4. Permissions → MFA Delete → Enable (requires root + MFA; follow console wizard).
  5. Object Lock can be skipped (extra cost/complexity).
  6. CloudTrail (free management events):
  7. CloudTrail → Create trail → apply to all regions → create new S3 bucket (or use existing) → enable for management events only → Create.
  8. Verify an event appears when you list the bucket or create a role.
  9. SageMaker notebook root-access control (conceptual + policy only – do not leave a notebook running):
  10. Create a simple IAM policy that denies sagemaker:CreateNotebookInstance unless "sagemaker:RootAccess": "Disabled": json { "Effect": "Deny", "Action": "sagemaker:CreateNotebookInstance", "Resource": "*", "Condition": { "StringNotEquals": {"sagemaker:RootAccess": "Disabled"} } }
  11. Attach to a test user/group. This enforces the secure setting at creation time.
  12. (Optional 2-minute live test – delete immediately)
  13. SageMaker → Notebook instances → Create (ml.t3.medium is among cheapest).
  14. Network = the private subnet + SG from Exercise 2 (or default VPC if you already deleted it).
  15. Direct internet access = Disabled.
  16. Root access = Disabled.
  17. Encryption key = aws/sagemaker.
  18. Create → wait until InService → open → confirm you cannot sudo.
  19. Immediately Stop → Delete the notebook and its EBS volume.
  20. Cleanup: Empty and delete any extra S3 buckets, delete the CloudTrail trail (the trail itself is free; only the small log volume in S3 incurs pennies), remove the deny policy if desired.

Expected result

  • Bucket shows versioning = Enabled, MFA Delete = Enabled, default encryption = AES-256.
  • CloudTrail logs every IAM and SageMaker API call.
  • Any attempt to create a notebook with RootAccess=Enabled is denied by IAM.
  • If you launched the brief notebook, it had no internet route and no root privileges.

Linked exam tips/traps

  • Trap: “just enable versioning” – MFA Delete is the extra control the exam likes for immutable model artifacts.
  • Tip: SageMaker encrypts inter-node traffic with a single flag; EFS/EBS/S3 need explicit KMS or SSE configuration.
  • Demonstrates defense-in-depth: encryption + versioning + MFA Delete + network isolation + root disabled + CloudTrail.
  • Shows how to troubleshoot: if a training job cannot read S3, check execution role + bucket policy + VPC endpoint + encryption key policy.

Quick Cleanup Checklist (Run After Every Session)


- Delete all SageMaker notebooks, endpoints, Studio apps/domains
- Delete VPC endpoints (especially interface), NAT Gateways, Elastic IPs
- Empty + delete test S3 buckets
- Delete unused IAM roles/policies
- Delete CloudTrail trails you created (optional)
- Confirm Cost Explorer or Bills shows no unexpected SageMaker/VPC endpoint charges

Additional Free Study Actions (Zero Cost)

  • Read the SageMaker Developer Guide sections: “SageMaker Roles”, “VPC mode”, “Protect Data at Rest/In Transit”, “Role Manager”.
  • Use IAM Access Analyzer on the roles you created.
  • Download a sample compliance report from AWS Artifact (free).
  • Review Well-Architected Security Pillar whitepaper – map each control you practiced to a question in the pillar.

By performing the three exercises above you will have touched every knowledge and skill bullet in Task 4.3 while keeping charges near zero. Focus on the combination of least-privilege IAM + VPC endpoints + encryption + auditing – that combination appears repeatedly on the MLA_C01 exam. Good luck!