A municipal eel-weir lab will not send water-chemistry prompts across the public internet. Which pattern keeps that traffic inside the VPC?
Select an answer to reveal the explanation.
Short Explanation
Think of water-chemistry prompts that must not cross the public internet. Use a private endpoint with AWS PrivateLink to Bedrock or SageMaker AI. A public chat is not that path.
Full Explanation
The municipal eel-weir lab will not send water-chemistry prompts across the public internet. The matching pattern is a private endpoint using AWS PrivateLink to Amazon Bedrock or Amazon SageMaker AI so traffic stays on the VPC path to the service. Prompts and responses avoid traversal of the public internet edge that the lab has ruled out for this sensitive environmental workload.
An open public invoke path fails because it contradicts the requirement to keep water-chemistry prompts off the public internet. Pasting prompts into a public chat fails for the same reason and adds uncontrolled third-party exposure of lab content. Amazon Transcribe fails because speech-to-text is a different service capability, not a VPC PrivateLink pattern for Bedrock or SageMaker AI invokes.
Exam caveat: PrivateLink addresses network path; teams must still apply IAM auth, encryption in transit, and logging—private networking is not a substitute for identity or data-handling controls. Operational check: create the interface VPC endpoint for the AI service, route the lab workload through it, confirm DNS resolves to private addresses, and verify with VPC flow logs or endpoint metrics that invokes are not egressing via a NAT path to the public API.