A company stores user clickstream data in an Amazon S3 bucket in AWS Account A. The company needs to use the data to train an ML model in Amazon SageMaker AI in AWS Account

Question

Options

• ASet up VPC peering between Account A and Account B. Contact AWS by email to opt out of
• BSet up a VPC endpoint for the S3 bucket. Set the SageMaker AI OPT_OUT_TRACKING
• CConfigure a security group policy that is assigned to the S3 bucket in Account A to allow access
• DGenerate presigned URLs with expiration times for the objects that are stored in the S3 bucket.

• A
  5% (3)
• B
  81% (47)
• C
  2% (1)
• D
  12% (7)

Explanation

The challenge is securely accessing S3 data from a different AWS account (Account A) for SageMaker training in Account B, while also addressing data privacy/tracking concerns. Option B uses a VPC endpoint for S3, which keeps traffic off the public internet and within the AWS network, enabling private cross-account access. Setting the SageMaker OPT_OUT_TRACKING environment variable ensures that sensitive clickstream data is not shared with AWS for service improvement. Option A (VPC peering + email opt-out) is not a standard or scalable approach - AWS opt-out isn't done via email. Option C (security group on S3) is incorrect - S3 uses bucket policies, not security groups. Option D (presigned URLs) is temporary and impractical for large-scale training jobs.

No community discussion yet for this question.