A water-plant endpoint’s security group allows 0.0.0.0/0 on the inference port “because the VPC is private.” A compromised host in another subnet can invoke it. What should they restrict?
Select an answer to reveal the explanation.
Short Explanation
The endpoint security group allows 0.0.0.0/0 on the inference port because the VPC is private. A private VPC does not isolate subnets from each other. Allow only the application-tier group that must invoke it.
Full Explanation
A private VPC does not isolate subnets from each other. The endpoint (or training) security group must allow only the application tier that should invoke it. 0.0.0.0/0 on the inference port lets a compromised peer host call it. Polly is not that rule, and opening training to the internet widens exposure.