A housing authority's case-management model endpoint must only be reachable from the internal subnets caseworkers use, not from the broader network. Which combination of controls best restricts access at the network level?
Select an answer to reveal the explanation.
Short Explanation
IAM tells you who's allowed to knock, but it doesn't lock the door to the building — that's a separate job. Putting the endpoint inside a VPC and fencing it in with security groups and an interface endpoint is what actually limits which network the traffic can even come from, so only the caseworker subnets can reach it in the first place.
Full Explanation
Network-level isolation and identity-level permissions solve different problems: IAM policies govern which authenticated principals are allowed to call an API action, while VPC placement plus security groups and an interface VPC endpoint govern which network paths can reach the endpoint at all — both matter, and neither substitutes for the other. Relying on IAM alone leaves the endpoint reachable over whatever network path exists, so a valid credential from outside the intended subnets could still connect if network controls aren't in place. A public endpoint with an unpublished URL is security by obscurity — the URL isn't secret in any technical sense and offers no actual restriction once discovered or logged anywhere. S3 bucket policies protect the stored model artifact at rest; they say nothing about who can reach the running, deployed endpoint that serves predictions, so they don't address live network access at all. Scope caveat: security group rules should be scoped as narrowly as the caseworker subnet ranges actually require, since overly broad CIDR ranges quietly erode the isolation the VPC placement is meant to provide. Operational check: attempt to reach the endpoint from outside the caseworker subnets and confirm the connection is refused before considering the deployment complete.