Endpoints inside VPCs
Lesson 3 of 4 in Provisioning ML Infrastructure as Code.
SageMaker AI is a managed service, so "put the endpoint in our VPC" actually means three different controls that stems love to blur. VpcConfig (subnets + security groups on the model) makes the inference containers reach resources through your VPC via elastic network interfaces. EnableNetworkIsolation goes further: the container gets no outbound network at all — SageMaker AI itself moves the artifacts and data in and out. And a VPC endpoint (AWS PrivateLink) covers the other direction: your calls to the SageMaker APIs — including every InvokeEndpoint — travel privately instead of crossing the public internet.
A fully private invocation path
- App in private subnet
No internet gateway, no NAT — by design.
- Interface endpoint: sagemaker.runtime
A PrivateLink ENI in your subnet; its security group admits the app. A sibling endpoint for the sagemaker API covers control-plane calls.
- InvokeEndpoint
Same API call as ever — DNS resolves to the private ENI.
- Model containers (VpcConfig)
Container traffic rides ENIs in the subnets you listed, filtered by your security groups.
- S3 via gateway endpoint
Artifacts and data reach S3 through the route table, not the internet. Training VPCs add ECR and CloudWatch Logs interface endpoints.
| Knob | What it actually isolates | The tell |
|---|---|---|
VpcConfig (subnets + security groups) | The containers' traffic — it flows through your VPC and your security groups | "The model must reach a database in our VPC" / "control container egress" |
EnableNetworkIsolation | Everything — the container can make no outbound calls, period | "The container must be prevented from calling out / exfiltrating", strictest compliance |
VPC endpoints (PrivateLink) | Your API calls to SageMaker AI — they never traverse the public internet | "Invoke the endpoint without crossing the internet", private subnets with no IGW/NAT |
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.