Compliance requires that model traffic never crosses the public internet. What do you configure?
Why C is the answer
VPC interface endpoints through AWS PrivateLink
PrivateLink keeps traffic inside the AWS network. A NAT gateway sends it out toward public endpoints.
In detail
- PrivateLink keeps traffic on the AWS network.
- Restrict access with endpoint policies as well.
Use case
An illustrative scenario, not a real incident.
A bank's rule forbids internet paths for model traffic. An interface endpoint through PrivateLink keeps calls inside the AWS network.
See it in different ways
flowchart LR A["App in a private subnet"] --> B["VPC endpoint"] B --> C["Amazon Bedrock"] D["IAM policy"] --> C E["KMS key"] --> F["Data at rest"]
sequenceDiagram participant U as User participant I as IAM participant G as Guardrails participant M as Model participant L as CloudTrail U->>I: Is this caller allowed? I->>G: Filter the input G->>M: Safe prompt M-->>G: Output G-->>U: Filtered output I->>L: Records the call
sequenceDiagram participant P0 as App in a VPC participant P1 as Interface endpoint participant P2 as Amazon Bedrock P0->>P1: Private request P1->>P2: Through PrivateLink P2-->>P0: Response
Key point: PrivateLink keeps traffic off the internet.
Why the other options are wrong
- A. A NAT gateway in a public subnet
- A NAT gateway reaches public endpoints.
- B. A public API protected by a long key
- A public API crosses the internet.
- D. A CloudFront distribution in front of the API
- CloudFront is a public edge service.