Security Controls
- Use least-privilege SageMaker execution roles.
- Encrypt S3 data, model artifacts, training volumes, and logs with KMS when required.
- Use VPC configuration and VPC endpoints for private data access.
- Separate permissions for data scientists, pipeline automation, and production deployment.
Exam Cues
- Need private access to S3 from a VPC: gateway endpoint.
- Need private access to SageMaker APIs: interface endpoint.
- Need customer-controlled encryption: customer managed KMS key.
- Need audit API activity: CloudTrail.
Practice ML Security Questions
Put your knowledge to the test with practice questions.