Model traffic must stay off the public internet. What do you use?
Why A is the answer
VPC endpoints
VPC endpoints keep model traffic on a private path, away from the public internet.
In detail
- VPC endpoints keep model traffic off the public internet.
- Add endpoint policies to limit access.
Use case
An illustrative scenario, not a real incident.
A health company keeps model calls inside its VPC through a VPC endpoint.
See it in different ways
flowchart LR A["App in a private subnet"] --> B["VPC endpoint"] B --> C["Amazon Bedrock"] D["IAM policy"] --> C E["KMS key"] --> F["Data at rest"]
sequenceDiagram participant U as User participant I as IAM participant G as Guardrails participant M as Model participant L as CloudTrail U->>I: Is this caller allowed? I->>G: Filter the input G->>M: Safe prompt M-->>G: Output G-->>U: Filtered output I->>L: Records the call
flowchart TD
Q{"Which path?"}
Q -->|"VPC endpoint"| A0["Stays private"]
Q -->|"Public endpoint"| A1["Goes over the internet"]Key point: VPC endpoints isolate traffic.
Why the other options are wrong
- B. A public API key rotated monthly
- A public key still uses the public internet.
- C. A CloudFront distribution with public access
- That is public.
- D. A larger NAT gateway in a public subnet
- A NAT gateway reaches public endpoints.