You work as a machine learning specialist for a company that is required to follow the Securities and Exchange Commission (SEC) regulations. One of the ways your company adheres to some of the SEC regulations is to apply a data security policy that does not allow the sending of your machine learning data over the internet. You are building a SageMaker environment to use for your team’s machine learning models. Which is the best option to make the SageMaker service available in your company’s AWS account without enabling direct internet access to your machine learning specialist’s SageMaker notebook instances?

Answer options:

A.Use Transit Gateway between your corporate VPC and the Amazon VPC hosting SageMaker.
B.Connect directly to the SageMaker runtime (the Amazon VPC hosting SageMaker) through an interface endpoint in your corporate VPC.C.Route your SageMaker traffic through a network in your corporate data center.
D.Use a NAT gateway in your corporate VPC to connect to the Amazon VPC hosting SageMaker.

Correct Answer: B
Option A is incorrect. A Transit Gateway is a network transit hub used for creating a VPC connection between your own VPCs and an on-premise network. It is not used to communicate with AWS services like SageMaker. VPC interface and gateway endpoints are used to accomplish private VPC connections to services like SageMaker.
Option B is correct. Using an interface endpoint in your VPC, you can connect directly to the SageMaker API or the SageMaker runtime without ever connecting over the internet. Using a VPC interface endpoint, communication between your VPC and the SageMaker runtime is conducted securely within the AWS network.
Option C is incorrect. Routing your SageMaker machine learning data through your corporate data center network will not give you access to the Amazon VPC hosting SageMaker.
Option D is incorrect. If you use a NAT Gateway, you will send your traffic over the internet. The scenario explicitly states that you cannot send your machine learning data over the internet.
References:
Please see the Amazon Virtual Private Cloud AWS PrivateLink page titled VPC endpoints (https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints.html),
The Amazon SageMaker development guide titled Connect to SageMaker Through a VPC Interface Endpoint (https://docs.aws.amazon.com/sagemaker/latest/dg/interface-vpc-endpoint.html),
The Amazon Virtual Private Cloud transit gateways guide titled What is a Transit Gateway? (https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html),
The Amazon Virtual Private Cloud VPC peering pagetitled Unsupported VPC peering configurations (https://docs.aws.amazon.com/vpc/latest/peering/invalid-peering-configurations.html)