Skip to content

Skill 3.2.4: Configure SageMaker AI endpoints within VPC network environments

Question 1 - VPC Endpoint Configuration for Private Model Artifact Access

A financial services company is deploying a fraud detection model on Amazon SageMaker AI real-time inference. The compliance team mandates that the model endpoint must be deployed in a private subnet with no internet access, and all communication with AWS services must remain on the AWS private network backbone.

During initial deployment, the endpoint fails to start because it cannot reach the Amazon S3 bucket containing the model artifacts (model.tar.gz). The VPC has private subnets across two Availability Zones, and no route to the internet exists.

Which TWO configurations should the machine learning engineer implement to resolve this issue while maintaining compliance? (Select TWO)

  • A) Add an Internet Gateway to the VPC and create a route in the private subnet route table pointing to it.
  • B) Create an Amazon S3 Gateway VPC Endpoint in the VPC and add a route to the private subnet route tables pointing to the endpoint.
  • C) Create an interface VPC endpoint for Amazon SageMaker Runtime to allow the endpoint to communicate with the SageMaker service.
  • D) Create a NAT Gateway in a public subnet and route all private subnet traffic through it.
  • E) Attach the AmazonSageMakerFullAccess managed policy to the endpoint's execution role.
Click to reveal Answer & Explanation

Correct Answers: B and C

Correct Options Analysis

  • B is Correct: An Amazon S3 Gateway VPC Endpoint provides private connectivity from private subnets to Amazon S3 without traversing the internet. Adding a route to the private subnet route tables pointing to the S3 gateway endpoint allows the SageMaker endpoint instances to download model artifacts privately.
  • C is Correct: SageMaker endpoints in a VPC require a VPC interface endpoint (AWS PrivateLink) for the SageMaker API and SageMaker Runtime services. This allows the endpoint's hosting instances to communicate with the SageMaker control plane to register their status without needing internet access.

Distractor Analysis

  • A is Incorrect: Adding an Internet Gateway and routing private subnet traffic to it defeats the compliance requirement of no internet access. Internet Gateways expose resources to the public internet.
  • D is Incorrect: A NAT Gateway enables outbound internet access from private subnets, which violates the "no internet access" compliance mandate. NAT Gateways also incur additional hourly and data processing charges.
  • E is Incorrect: While the execution role needs IAM permissions (like s3:GetObject) to access model artifacts, AmazonSageMakerFullAccess alone does not resolve VPC network connectivity. IAM permissions and network routing are separate requirements.

Key Takeaway: Private subnets without internet routes require VPC endpoints—Gateway endpoints for S3/DynamoDB and interface endpoints for most other AWS services—to maintain full private connectivity.

Question 2 - Multi-AZ Subnet Requirements and ENI Creation

A healthcare analytics firm is deploying a clinical note summarization model to a SageMaker AI real-time endpoint. The endpoint must be deployed inside a VPC to comply with HIPAA requirements.

The machine learning engineer configures the endpoint with a VPC configuration specifying a single private subnet in us-east-1a. During deployment, the endpoint creation fails with an error indicating issues related to network interface configuration.

What is the MOST LIKELY cause of this failure?

  • A) The security group attached to the endpoint does not allow inbound traffic on port 8080.
  • B) SageMaker AI endpoints deployed within a VPC require subnets spanning at least two Availability Zones for high availability.
  • C) The execution role lacks the ec2:CreateNetworkInterface permission required to create and attach an elastic network interface to the endpoint instances.
  • D) The subnet does not have an Internet Gateway route, preventing instance health checks from completing.
Click to reveal Answer & Explanation

Correct Answer: B

Correct Options Analysis

  • B is Correct: When deploying SageMaker AI real-time endpoints inside a VPC, SageMaker requires that you provide at least two subnets in different Availability Zones. SageMaker creates one or more elastic network interfaces (ENIs) in each subnet specified. If only one subnet is provided, the endpoint creation fails during the network interface provisioning stage. This is a hard requirement regardless of whether you need high availability for the workload.

Distractor Analysis

  • A is Incorrect: While security group rules are important for inference traffic to reach the endpoint, a misconfigured security group typically causes invocation failures after deployment, not endpoint creation failures related to network interface configuration.
  • C is Incorrect: While the execution role does need appropriate permissions for network operations, the error described specifically points to subnet configuration. Missing ec2:CreateNetworkInterface would produce an explicit IAM authorization error.
  • D is Incorrect: While endpoints in private subnets without internet access may require VPC endpoints to communicate with AWS services, the two-AZ subnet requirement is a deployment-level constraint that takes precedence before any network routing is evaluated.

Key Takeaway: SageMaker VPC endpoint configuration requires subnets in at least two Availability Zones at deployment time—this is a foundational requirement before any other network configuration.

Question 3 - Serverless Endpoint Limitation with VPC Requirements

A startup is building a low-traffic internal tool that uses a SageMaker AI Serverless Inference endpoint to host a lightweight classification model. The company's cloud architect requires that all production endpoints be deployed inside a VPC for network isolation and security.

The machine learning engineer attempts to configure the serverless endpoint with VpcConfig specifying private subnets and security groups. The deployment fails.

What is the correct conclusion about this scenario?

  • A) Serverless endpoints can be deployed in VPCs, but only with public subnets.
  • B) Serverless endpoints deployed in VPCs require NAT Gateways for all outbound traffic.
  • C) SageMaker Serverless Inference does not support VPC network configuration; a real-time endpoint with VPC configuration must be used instead.
  • D) The execution role needs additional ec2:CreateNetworkInterface permissions for serverless endpoints in VPCs.
Click to reveal Answer & Explanation

Correct Answer: C

Correct Options Analysis

  • C is Correct: SageMaker Serverless Inference endpoints do not support VPC network configuration. The VpcConfig parameter is not available for serverless endpoints. If an organization mandates that all hosted models must reside inside a VPC, the only SageMaker inference option is a real-time endpoint configured with VpcConfig specifying subnets and security groups. This constraint often dictates the choice of inference deployment type even before other considerations like latency or scaling are evaluated.

Distractor Analysis

  • A is Incorrect: Serverless endpoints do not support VPC deployment with any subnet type (public or private). The serverless compute infrastructure is fully managed by AWS and runs outside the customer's VPC.
  • B is Incorrect: NAT Gateways are not applicable to serverless endpoints because they do not operate within a customer-managed VPC at all.
  • D is Incorrect: This is an IAM permission that applies to real-time endpoints using network isolation. Serverless endpoints do not create ENIs in customer VPCs, so this permission is irrelevant.

Key Takeaway: If compliance or architecture requires VPC isolation, serverless inference is not an option—the choice is immediately constrained to real-time or batch transform with VPC configuration.

A machine learning platform team has a central model registry in an AWS account (Account A) that hosts models for multiple business units. A data science team in a different AWS account (Account B) deploys these models using SageMaker AI endpoints in their own VPC.

The endpoints in Account B must pull model artifacts from an S3 bucket in Account A without traversing the public internet. The S3 bucket policy allows access only from the Account B VPC endpoint ID.

Which configuration must be implemented to enable this cross-account private access?

  • A) Create an S3 Gateway VPC Endpoint in Account A's VPC and route traffic from Account B's private subnets to it.
  • B) Configure an S3 Access Point in Account A with a public internet alias and use that from Account B's VPC.
  • C) Create an S3 Gateway VPC Endpoint in Account B's VPC and add a route to Account B's private subnet route tables, ensuring the S3 bucket policy references the Account B endpoint ID.
  • D) Use AWS Resource Access Manager (RAM) to share the SageMaker endpoint's VPC with Account A's S3 bucket.
Click to reveal Answer & Explanation

Correct Answer: C

Correct Options Analysis

  • C is Correct: To allow resources in Account B's VPC to privately access an S3 bucket in Account A, you create an S3 Gateway VPC Endpoint in Account B's VPC. When Account B's endpoints route traffic through this gateway endpoint to S3, the S3 bucket policy in Account A must reference the Account B VPC endpoint ID (aws:sourceVpce) to allow cross-account access. This maintains private network connectivity while enforcing fine-grained access control.

Distractor Analysis

  • A is Incorrect: VPC endpoints are not shared across accounts. A VPC endpoint in Account A's VPC cannot be used to route traffic from Account B's VPC. Each account's VPC requires its own endpoints.
  • B is Incorrect: Using a public internet alias or public S3 URL violates the requirement of no public internet traversal.
  • D is Incorrect: AWS RAM shares resources like subnets across accounts within an AWS Organization, but it cannot share a SageMaker endpoint's VPC with an S3 bucket. This option confuses resource sharing concepts.

Key Takeaway: Cross-account private S3 access requires the gateway endpoint in the requesting account's VPC, with the bucket policy in the owning account authorizing that specific endpoint ID.

Question 5 - Network Security Configuration for Endpoint Invocation

A retail company deploys a recommendation model to a SageMaker AI real-time endpoint within a VPC. The endpoint serves internal services running in the same VPC.

The machine learning engineer creates a security group (sg-endpoint) and attaches it to the endpoint. The internal microservices can reach the endpoint for a few minutes after deployment, but then invocations begin failing with timeout errors.

Investigation reveals that SageMaker has scaled the endpoint variant from 1 to 3 instances. What is the root cause of the invocation failures?

  • A) The security group (sg-endpoint) does not allow inbound traffic from the internal microservices on the serving container's port (e.g., 8080).
  • B) The internal microservices' security group does not allow outbound traffic to the endpoint's security group.
  • C) The security group (sg-endpoint) has a rule that was automatically deleted when the endpoint scaled out.
  • D) The endpoint's execution role does not have permission to create new network interfaces for the additional instances.
Click to reveal Answer & Explanation

Correct Answer: A

Correct Options Analysis

  • A is Correct: When a SageMaker endpoint is created within a VPC, the endpoint's security group must allow inbound traffic on the container's serving port (8080 for SageMaker built-in containers, or the custom port specified for custom containers) from the client services' security group or CIDR range. When the endpoint scaled from 1 to 3 instances, the three instances were placed behind a load balancer, and the requests were distributed to the new instances. The security group is applied to all instances, so if the rule was missing from the beginning, the initial single instance would also have been unreachable. However, if the initial instance briefly worked due to security group state propagation timing, the scale-out would expose the missing rule more consistently.

Distractor Analysis

  • B is Incorrect: While outbound rules in the client's security group are often open by default (Allow All Outbound), the key check is on the endpoint's security group inbound rules. Outbound rules rarely change unless explicitly modified.
  • C is Incorrect: AWS does not automatically delete security group rules. Security groups are immutable configurations that persist unless manually changed.
  • D is Incorrect: If the execution role lacked ec2:CreateNetworkInterface permission, the endpoint would fail during deployment or scaling, not produce timeout errors during invocation. The issue here is a pre-existing security group rule gap exposed by additional instances.

Key Takeaway: The endpoint's security group must have inbound rules allowing traffic on the serving port from the caller's security group or CIDR; scale-out events can expose missing rules when traffic routes to new instances.

Question 6 - Execution Role Permissions for ENI Creation

A machine learning operations team is creating an AWS CloudFormation template to deploy a SageMaker AI endpoint inside a VPC. The endpoint uses a custom container from Amazon ECR and reads inference configuration from AWS Systems Manager Parameter Store.

During the first deployment, the stack fails with an error indicating that the endpoint's execution role does not have the necessary permissions to create and manage network interfaces in the VPC.

Which TWO IAM permissions MUST be added to the endpoint's execution role? (Select TWO)

  • A) ec2:CreateNetworkInterface
  • B) ec2:DeleteNetworkInterface
  • C) sagemaker:CreateEndpoint
  • D) ec2:DescribeNetworkInterfaces
  • E) vpc:CreateVpcEndpoint
Click to reveal Answer & Explanation

Correct Answers: A and D

Correct Options Analysis

  • A is Correct: When SageMaker deploys an endpoint into a VPC, it needs to create elastic network interfaces (ENIs) in the specified subnets. The execution role must have ec2:CreateNetworkInterface permission.
  • D is Correct: SageMaker must be able to describe the existing network interfaces and associated resources (like security groups and subnets) to manage lifecycle operations. ec2:DescribeNetworkInterfaces is essential for this purpose.

Distractor Analysis

  • B is Incorrect: While the execution role may need ec2:DeleteNetworkInterface for endpoint deletion and updates, this question specifically asks about the creation failure. The two critical permissions for deployment are CreateNetworkInterface and DescribeNetworkInterfaces. Full network interface management includes delete permissions, but that would be required at teardown, not deployment.
  • C is Incorrect: sagemaker:CreateEndpoint is an API-level permission required for the AWS user or service calling the SageMaker API, not the endpoint's execution role. The execution role is assumed by the SageMaker service to access other resources.
  • E is Incorrect: vpc:CreateVpcEndpoint is required for creating VPC endpoints (PrivateLink/Gateway endpoints), not for SageMaker's network interface management. The VPC endpoints are created independently by the network administrator.

Key Takeaway: SageMaker VPC endpoint deployment requires the execution role to include ec2:CreateNetworkInterface and ec2:DescribeNetworkInterfaces; missing ENI permissions are a common first-deployment failure.

Question 7 - Private Access to ECR Images for Custom Containers

A government agency is deploying a custom inference container stored in Amazon ECR to a SageMaker AI real-time endpoint configured within private subnets that have no internet access.

The endpoint fails to start because it cannot pull the container image from ECR. The VPC already has an S3 Gateway VPC Endpoint configured.

Which configuration is REQUIRED to resolve this issue?

  • A) Add an Internet Gateway to the VPC and route all traffic through it.
  • B) Create VPC interface endpoints for com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr, enabling private DNS for both endpoints.
  • C) Use ECR Public Gallery instead of private ECR repositories.
  • D) Configure the endpoint's execution role to use ecr:GetDownloadUrlForLayer via a public endpoint.
Click to reveal Answer & Explanation

Correct Answer: B

Correct Options Analysis

  • B is Correct: When SageMaker endpoints use custom containers from Amazon ECR in a private VPC without internet access, you must create VPC interface endpoints (AWS PrivateLink) for both the ECR API (com.amazonaws.region.ecr.api) and the ECR Docker registry (com.amazonaws.region.ecr.dkr). Enable private DNS on both endpoints so that the Docker client resolves the ECR DNS names to the private IP addresses within the VPC.

Distractor Analysis

  • A is Incorrect: An Internet Gateway routes traffic to the public internet, which violates the "no internet access" requirement for this government workload.
  • C is Incorrect: ECR Public Gallery hosts publicly available images, but the organization needs a private repository for its custom container. Additionally, using a public gallery would still require internet access.
  • D is Incorrect: While the execution role needs ecr:GetDownloadUrlForLayer permission, this alone does not resolve network connectivity. IAM permissions are separate from network routing; both are required but serve different purposes.

Key Takeaway: Private VPC deployments with custom ECR containers require both ecr.api and ecr.dkr VPC interface endpoints with private DNS enabled—these are separate endpoints with distinct purposes.

Question 8 - Scaling Configuration with VPC Endpoint Capacity

An e-commerce platform expects significant traffic growth for a product recommendation model during peak season. The endpoint is deployed within a VPC that has been working correctly for baseline traffic.

The application team configures Application Auto Scaling to scale the endpoint from 2 instances (baseline) to a maximum of 20 instances during peak periods. During the first surge, the scaling action fails and the endpoint remains at 2 instances.

What is the MOST LIKELY root cause?

  • A) The Application Auto Scaling policy's cooldown period is too aggressive, preventing rapid scale-out.
  • B) The VPC's subnets do not have enough available IP addresses to create the additional 18 elastic network interfaces required for the new instances.
  • C) The endpoint's security group has a maximum of 2 inbound rules, limiting the number of instances that can be attached.
  • D) The scaling metric (SageMakerVariantInvocationsPerInstance) is not published frequently enough to trigger the scaling event.
Click to reveal Answer & Explanation

Correct Answer: B

Correct Options Analysis

  • B is Correct: Each SageMaker endpoint instance deployed within a VPC requires elastic network interface (ENI) resources, including IP addresses in the specified subnets. If the subnets have insufficient free IP addresses (e.g., a /27 subnet with only 27 usable addresses), the scaling action cannot create the additional ENIs for new instances. This is a common scaling failure in VPC deployments, especially when multiple SageMaker endpoints share the same subnets.

Distractor Analysis

  • A is Incorrect: Cooldown periods affect the timing of scaling actions, not the ability to successfully create new instances. A scaling action that "fails" suggests a resource constraint, not a scheduling delay.
  • C is Incorrect: Security groups do not limit the number of instances. A security group can be associated with any number of ENIs. The 60 inbound rule limit per security group is about rule count, not instance count.
  • D is Incorrect: SageMakerVariantInvocationsPerInstance is a standard metric emitted by SageMaker and is appropriate for target tracking scaling. If the metric were insufficient, the policy would not trigger at all, but the question states the scaling action failed after being triggered.

Key Takeaway: VPC subnet IP address capacity is a hidden constraint for endpoint scaling—always plan CIDR ranges with headroom for maximum instance counts, accounting for one ENI per instance.

Question 9 - Private Access to Bedrock from SageMaker Endpoint

A machine learning team is building an inference pipeline where a SageMaker AI endpoint in a VPC processes input data and then calls Amazon Bedrock for content moderation before returning the final response. The VPC has no internet access.

The endpoint can process data correctly, but the call to Bedrock fails with a network error. Which configuration enables private communication between the SageMaker endpoint and Bedrock?

  • A) Create an interface VPC endpoint for the Bedrock service (com.amazonaws.region.bedrock-runtime) and assign it to the private subnets, then update the endpoint's security group to allow outbound traffic to the VPC endpoint's security group.
  • B) Add a NAT Gateway to the VPC and route all Bedrock API calls through it.
  • C) Enable bedrock:InvokeModel permission in the endpoint's execution role and retry the request.
  • D) Create a VPC peering connection between the SageMaker VPC and the Bedrock service VPC.
Click to reveal Answer & Explanation

Correct Answer: A

Correct Options Analysis

  • A is Correct: Amazon Bedrock is accessed through AWS API calls. To reach Bedrock from a private VPC without internet access, you must create a VPC interface endpoint (AWS PrivateLink) for com.amazonaws.region.bedrock-runtime (for model invocation) and optionally com.amazonaws.region.bedrock (for control plane operations). Attach this interface endpoint to the private subnets and ensure the endpoint's security group allows outbound traffic to the Bedrock VPC endpoint's security group on port 443.

Distractor Analysis

  • B is Incorrect: A NAT Gateway enables outbound internet access, which violates the "no internet access" constraint. Additionally, NAT Gateways add per-hour and per-GB data processing charges.
  • C is Incorrect: While the execution role needs bedrock:InvokeModel IAM permission for the Bedrock API call, this is an authorization concern, not a network connectivity issue. The question describes a "network error," indicating the traffic cannot even reach the Bedrock endpoint.
  • D is Incorrect: VPC peering connects two customer-owned VPCs. Amazon Bedrock does not have a customer-accessible VPC; it exposes API endpoints through the AWS service network, requiring PrivateLink for private access.

Key Takeaway: Private access to AWS API-based services (Bedrock, SageMaker API, etc.) from VPCs requires AWS PrivateLink interface endpoints in the local VPC—not peering, NAT, or IAM fixes.

Question 10 - VPC Endpoint Configuration Validation and Network Troubleshooting

An ML infrastructure team is diagnosing intermittent latency issues with a SageMaker AI real-time endpoint deployed in a VPC. The endpoint writes inference results to Amazon S3 and sends monitoring metrics to Amazon CloudWatch using custom logic inside the inference container.

The endpoint is configured with:

  • Private subnets in 2 AZs
  • Security group allowing outbound traffic to all destinations within the VPC CIDR
  • S3 Gateway VPC Endpoint
  • CloudWatch Logs interface VPC endpoint

The team notices that S3 writes complete successfully, but CloudWatch metric publishing fails intermittently. What is the most likely cause?

  • A) The S3 Gateway VPC Endpoint route table does not include the private subnets.
  • B) The security group's outbound rules do not allow traffic to the CloudWatch interface VPC endpoint's subnet CIDR on port 443.
  • C) The endpoint's execution role lacks cloudwatch:PutMetricData permission.
  • D) The CloudWatch interface VPC endpoint's security group does not allow inbound traffic from the endpoint's security group on port 443.
Click to reveal Answer & Explanation

Correct Answer: D

Correct Options Analysis

  • D is Correct: When an interface VPC endpoint (like CloudWatch) is deployed in a VPC, it has its own security group controlling inbound traffic. The endpoint's security group must explicitly allow inbound HTTPS (port 443) traffic from the SageMaker endpoint's security group (or the endpoint's subnet CIDR). If this rule is missing or misconfigured, traffic from the endpoint to CloudWatch will intermittently fail (especially under retry/backoff timing).

Distractor Analysis

  • A is Incorrect: The question states S3 writes complete successfully, which means S3 connectivity works. If the S3 Gateway endpoint route were missing from the subnet route tables, S3 writes would also fail.
  • B is Incorrect: While the endpoint's security group outbound rules need to allow traffic to the CloudWatch endpoint, the question describes intermittent failures, suggesting a partial configuration issue rather than a complete block. Even if outbound rules are correctly configured, the VPC endpoint's own security group must allow the traffic.
  • C is Incorrect: If the IAM permission (cloudwatch:PutMetricData) were missing, the failure would be consistent and include an explicit authorization error, not intermittent and network-related.

Key Takeaway: Interface VPC endpoints have their own security groups—troubleshoot private connectivity by checking both the source's outbound rules and the destination endpoint's inbound rules.