An application in a VPC accesses an AI service and sensitive S3 data.
Avoid unnecessary Internet paths and use least privilege.
Choose two appropriate controls.
Consider private service connectivity and layer network controls with IAM and resource policies.
Detailed explanation
Private connectivity reduces dependence on public paths.
Private connectivity reduces dependence on public paths.
Network and API/resource controls protect different layers.
Network and API/resource controls protect different layers.
Network isolation and authorization are separate controls.
Network isolation and authorization are separate controls.
This is broader than the requirement.
This is broader than the requirement.
Try it yourself
An example you can run in a temporary verification environment.
AWS公式VPCエンドポイント、Amazon S3ポリシー、AIサービス接続の説明を確認する。Expected result
ネットワーク隔離と認可を別レイヤーとして設計できる。Key points
- VPC endpoint
- Defense in depth
- Authorization
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.