SAP-C02 · Question #614
A team of data scientists is using Amazon SageMaker instances and SageMaker APIs to train machine learning (ML) models. The SageMaker instances are deployed in a VPC that does not have access to or fr
The correct answer is D. Create an AWS CodeArtifact domain and repository. Add an external connection for public:pypi to. To allow SageMaker instances in an internet-isolated VPC to access PyPI packages, establish an AWS CodeArtifact repository with an external connection to public PyPI and configure SageMaker to use CodeArtifact as a private mirror accessible via VPC endpoints.
Question
A team of data scientists is using Amazon SageMaker instances and SageMaker APIs to train machine learning (ML) models. The SageMaker instances are deployed in a VPC that does not have access to or from the internet. Datasets for ML model training are stored in an Amazon S3 bucket. Interface VPC endpoints provide access to Amazon S3 and the SageMaker APIs. Occasionally, the data scientists require access to the Python Package Index (PyPI) repository to update Python packages that they use as part of their workflow. A solutions architect must provide access to the PyPI repository while ensuring that the SageMaker instances remain isolated from the internet. Which solution will meet these requirements?
Options
- ACreate an AWS CodeCommit repository for each package that the data scientists need to access.
- BCreate a NAT gateway in the VPC. Configure VPC routes to allow access to the internet with a
- CCreate a NAT instance in the VPConfigure VPC routes to allow access to the internet. Configure
- DCreate an AWS CodeArtifact domain and repository. Add an external connection for public:pypi to
How the community answered
(36 responses)- A6% (2)
- B14% (5)
- C3% (1)
- D78% (28)
Why each option
To allow SageMaker instances in an internet-isolated VPC to access PyPI packages, establish an AWS CodeArtifact repository with an external connection to public PyPI and configure SageMaker to use CodeArtifact as a private mirror accessible via VPC endpoints.
Creating an AWS CodeCommit repository for each package would require manual synchronization and management of hundreds or thousands of packages, which is not a scalable or practical solution for PyPI access.
Creating a NAT gateway in the VPC provides outbound internet access, which directly violates the requirement that SageMaker instances remain isolated from the internet.
Creating a NAT instance in the VPC, similar to a NAT gateway, provides outbound internet access, again violating the strict internet isolation requirement for the SageMaker instances.
Creating an AWS CodeArtifact domain and repository with an external connection to public PyPI allows SageMaker instances to fetch packages securely through the private CodeArtifact endpoint, without requiring direct internet access for the instances themselves.
Concept tested: AWS CodeArtifact, private package management, VPC isolation
Source: https://docs.aws.amazon.com/codeartifact/latest/ug/using-pypi-packages.html
Community Discussion
No community discussion yet for this question.