Notebooks in a private subnet must call SageMaker APIs without a NA…

Question

Notebooks in a private subnet must call SageMaker APIs without a NAT path to the public SageMaker endpoint. What should they create?

Accepted Answer

Interface VPC endpoints (PrivateLink) for SageMaker and related APIs so control-plane calls stay on the private network. — Notebooks in a private subnet must call SageMaker APIs without a NAT hop. Create interface VPC endpoints so control-plane calls stay private. A NAT-only path or a public-subnet move puts those calls on the internet.

Answer

A public NAT gateway as the only path, because SageMaker APIs cannot use a VPC endpoint.

Answer

Amazon Transcribe, because speech-to-text is a SageMaker API endpoint.

Answer

Move the notebooks to a public subnet so the control plane is reachable without PrivateLink.

Notebooks in a private subnet must call SageMaker APIs without a NAT path to the public SageMaker endpoint. What should they create?

Short Explanation

Full Explanation