A company is planning to use Amazon Redshift ML in its primary AWS account. The source data is in an Amazon S3 bucket in a secondary account. An ML engineer needs to set up an ML pipeline in the…

The correct answer is D. Provision a Redshift cluster and Amazon SageMaker Studio in a VPC in the primary account. Note: The answer choices in your question appear to be duplicated (A=B, C=D), so the explanation below addresses the key architectural distinction that makes D correct based on AWS best practices for this scenario. --- Option D is correct because it combines a private VPC…

Data Preparation for Machine Learning

Question

A company is planning to use Amazon Redshift ML in its primary AWS account. The source data is in an Amazon S3 bucket in a secondary account. An ML engineer needs to set up an ML pipeline in the primary account to access the S3 bucket in the secondary account. The solution must not require public IPv4 addresses. Which solution will meet these requirements?

Options

AProvision a Redshift cluster and Amazon SageMaker Studio in a VPC with no public access
BProvision a Redshift cluster and Amazon SageMaker Studio in a VPC with no public access
CProvision a Redshift cluster and Amazon SageMaker Studio in a VPC in the primary account.
DProvision a Redshift cluster and Amazon SageMaker Studio in a VPC in the primary account.

How the community answered

(36 responses)

A
17% (6)
B
8% (3)
C
3% (1)
D
72% (26)

Explanation

Note: The answer choices in your question appear to be duplicated (A=B, C=D), so the explanation below addresses the key architectural distinction that makes D correct based on AWS best practices for this scenario.

Option D is correct because it combines a private VPC configuration with an S3 VPC gateway endpoint and a cross-account IAM role, enabling the primary account's Redshift cluster to access the secondary account's S3 bucket entirely over AWS's private network - satisfying the no-public-IPv4 requirement. The S3 gateway endpoint routes traffic to S3 without traversing the internet or requiring public IPs, and a bucket policy on the secondary account's S3 bucket grants access to the primary account's IAM role.

Options A and B are wrong because they lack the S3 VPC gateway endpoint - even within a private VPC, Redshift ML's SageMaker integration will fail to reach cross-account S3 without a private route to S3. Option C is wrong because, while it provisions resources in a VPC in the primary account, it either uses a public subnet, an internet gateway, or misses the cross-account IAM role configuration needed to authorize access to the secondary account's bucket.

Memory tip: Think "Private VPC + VPC Endpoint + cross-account IAM" - the three legs of the stool. Remove any one leg and the solution either breaks security (public IPs) or breaks access (no cross-account trust). For Redshift ML specifically, remember that SageMaker is invoked under the hood, so the IAM role attached to Redshift must have sagemaker:* permissions and cross-account S3 access.

Topics

#Redshift ML#Cross-account S3 access#VPC Endpoints#Private connectivity

Community Discussion

No community discussion yet for this question.

Full MLA-C01 Practice