A company provisions Amazon SageMaker notebook instances for its data science team and creates Amazon VPC interface endpoints to ensure communication between the VPC and the notebook instances. All…

Question

Options

• AModify the notebook instances' security group to allow traffic only from the CIDR ranges of the
• BCreate an IAM policy that allows the sagemaker:CreatePresignedNotebooklnstanceUrl and
• CAdd a NAT gateway to the VPC. Convert all of the subnets where the Amazon SageMaker
• DChange the network ACL of the subnet the notebook is hosted in to restrict access to anyone

• A
  15% (4)
• B
  74% (20)
• C
  7% (2)
• D
  4% (1)

Explanation

SageMaker notebook instances are accessed via presigned URLs generated by the CreatePresignedNotebookInstanceUrl API call. Even with VPC interface endpoints configured, if users outside the VPC can call this API and obtain a presigned URL, they can access the notebook over the internet. The fix is to create an IAM policy that restricts the sagemaker:CreatePresignedNotebookInstanceUrl permission so it can only be invoked from within the VPC (using the aws:SourceVpc or aws:SourceVpce condition key). This ensures presigned URLs can only be generated by principals operating inside the VPC. Security group rules (A) control network-level access but cannot block access via a presigned URL fetched externally. Adding a NAT gateway (C) enables outbound internet access, the opposite of what is needed. Network ACLs (D) are stateless and subnet-level - they do not block presigned URL-based application access.

No community discussion yet for this question.