Play free

AI World 5 · Serve and Secure · Stage 3

Keep It Private

A loan app with no internet path calls its model and Amazon Bedrock through the VPC, only what it should, and a model container that never calls out.

  • Interface endpoints and private DNS
  • Endpoint policies and aws:sourceVpce
  • Network isolation
Domain
AI and machine learning
World
AI World 5: Serve and Secure (Associate)
Game type
Network build: Place gateways, routes and rules on a VPC, then follow each packet.
Time
About 25 minutes on a first attempt (estimated)
Exam guides
  • MLA-C02Skill 3.2.4: Configure SageMaker AI endpoints within VPC network environments; Skill 4.3.6: Create VPCs, subnets, and security groups to securely isolate ML and AI systems
  • AIP-C01Skill 2.3.3: Create secure access frameworks to ensure appropriate security controls (for example, by using identity federation between FM services and enterprise systems, role-based access control for model and data access, least privilege API access to FMs); Skill 3.2.1: Develop protected AI environments to ensure comprehensive security for FM deployments (for example, by using VPC endpoints to isolate networks, IAM policies to enforce secure data access patterns, AWS Lake Formation to provide granular data access, CloudWatch to monitor data access)