AIP-C01 · Question #26
A company runs a generative AI (GenAI)-powered summarization application in an application AWS account that uses Amazon Bedrock. The application architecture includes an Amazon API Gateway REST API…
The correct answer is B. Run Lambda functions in private subnets. Configure a NAT gateway to provide access to Amazon. The first option labeled B is the correct solution because it fully satisfies both private connectivity and fine-grained cross-account data governance requirements using AWS-native services. Creating interface VPC endpoints for Amazon Bedrock runtimes ensures that all inference…
Question
A company runs a generative AI (GenAI)-powered summarization application in an application AWS account that uses Amazon Bedrock. The application architecture includes an Amazon API Gateway REST API that forwards requests to AWS Lambda functions that are attached to private VPC subnets. The application summarizes sensitive customer records that the company stores in a governed data lake in a centralized data storage account. The company has enabled Amazon S3, Amazon Athena, and AWS Glue in the data storage account. The company must ensure that calls that the application makes to Amazon Bedrock use only private connectivity between the company's application VPC and Amazon Bedrock. The company's data lake must provide fine-grained column-level access across the company's AWS accounts. Which solution will meet these requirements?
Options
- AIn the application account, create interface VPC endpoints for Amazon Bedrock runtimes. Run
- BRun Lambda functions in private subnets. Configure a NAT gateway to provide access to Amazon
- CCreate a gateway endpoint only for Amazon S3 in the application account. Invoke Amazon
- DUse VPC endpoints to provide access to Amazon Bedrock and Amazon S3 in the application
How the community answered
(36 responses)- A6% (2)
- B56% (20)
- C17% (6)
- D22% (8)
Explanation
The first option labeled B is the correct solution because it fully satisfies both private connectivity and fine-grained cross-account data governance requirements using AWS-native services. Creating interface VPC endpoints for Amazon Bedrock runtimes ensures that all inference calls remain on the AWS private network and never traverse the public internet. Running AWS Lambda functions in private subnets enforces network isolation, and using IAM conditions that restrict access to specific VPC endpoints and roles prevents unauthorized inference calls. For the governed data lake, AWS Lake Formation LF-tag-based access control is the recommended AWS mechanism for enforcing cross-account, column-level permissions. LF-tags allow the company to define data access policies once and apply them consistently across accounts, databases, tables, and even individual columns. This is required for sensitive customer records and is not achievable with S3 bucket policies or IAM alone.
Topics
Community Discussion
No community discussion yet for this question.