A VPC application connects privately to S3 and inference.
Avoid the public Internet and limit allowed operations.
Choose two designs.
Combine endpoint, route, security-group, IAM, resource-policy, and endpoint-policy controls with audit logging.
Detailed explanation
Both path and permitted operations are controlled.
Both path and permitted operations are controlled.
Private routing does not remove authorization and audit needs.
Private routing does not remove authorization and audit needs.
The scope is still too broad.
The scope is still too broad.
Misconfiguration and compromise may go undetected.
Misconfiguration and compromise may go undetected.
Try it yourself
An example you can run in a temporary verification environment.
AWS公式VPCエンドポイント、IAM、PrivateLinkとAIF-C01 Domain 5.1を確認する。Expected result
ネットワーク分離と認可・監査を別の防御層として設計できる。Key points
- VPC endpoint
- Endpoint policy
- Defense in depth
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.