VPCs, KMS, and Secrets Manager
Lesson 2 of 4 in Securing ML and AI Workloads.
By default, managed ML services reach S3 and each other over AWS's network with public API endpoints. Regulated workloads want a stronger statement: this model and its data never had an internet path. The pieces: give training jobs, endpoints, and Studio a VpcConfig (your subnets + security groups) so traffic originates in your VPC; add VPC endpoints — a gateway endpoint for S3, interface endpoints (PrivateLink) for the SageMaker API and Runtime — so even calls to AWS services traverse private links; run Studio/notebooks in VPC-only mode (no direct internet); and for the strictest tier, set network isolation on the training job, which cuts the container off from all network access — it sees only the data SageMaker mounts in and the artifact path out.
| Data at rest | What the CMK encrypts |
|---|---|
Training data in S3 | Objects via SSE-KMS on the dataset bucket — the key policy becomes a second gate on reads |
Training/processing job volumes | The EBS/ML storage volumes attached to job instances (the job’s volume KMS key setting) |
Model artifacts | model.tar.gz written to the output S3 location, under your key — control of the key is control of the model |
Endpoint storage | The ML storage volumes of hosting instances serving the model |
Two more pieces complete the picture. In transit, AWS APIs and SageMaker traffic use TLS — scenario answers that invent unencrypted hops inside SageMaker are distractors; the thing you configure is at-rest key choice, not transport. And credentials in pipelines belong in AWS Secrets Manager: the feature-ingestion job that reads a warehouse, the labeling webhook with an API token — store the secret once, grant the job's execution role permission to read that secret, rotate on schedule. The anti-patterns the exam loves to catch: credentials hardcoded in notebooks, baked into container images, or passed as plaintext environment variables.
Interactive sorting exercise: Which mechanism answers each requirement?
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.