Scenario: An ML pipeline uses a SageMaker Service API VPC interface endpoint in a public subnet. The team must ensure that only specific Amazon EC2…

To secure a VPC interface endpoint according to the principle of least privilege, a layered security approach is required, combining network-level and identity-level controls.

1. Network-Level Control: Security groups act as a stateful firewall for the endpoint's Elastic Network Interface (ENI). By configuring the security group (Option C) to only allow inbound traffic from the security group associated with the approved EC2 instances, you restrict network access to only those specific instances.

2. Identity-Level Control: VPC endpoint policies are IAM resource policies that control which principals (users, roles) can use the endpoint. Attaching a custom policy (Option D) that explicitly lists the ARNs of the allowed IAM users and roles ensures that only authorized identities can perform SageMaker API operations through the endpoint, regardless of their network location (within the allowed set).

Combining these two controls effectively enforces the requirement that only specific users from specific instances can access the API.

A. Private DNS simplifies endpoint resolution within the VPC but does not provide any access control or security filtering based on instance or IAM identity.

B. This describes a reactive detection and response mechanism. The requirement is for a proactive, preventative control to ensure access is restricted, which is the primary function of security groups and endpoint policies.

E. Deploying a separate endpoint for runtime traffic is a valid architectural pattern for isolating workloads but does not secure the existing SageMaker Service API endpoint as the question requires.

1. AWS Documentation: Control access to services using VPC endpoints. This document explicitly states the two primary methods for controlling access: "When you create an interface endpoint, you can attach an endpoint policy to it... You can also associate security groups with the endpoint network interfaces for an interface endpoint." This confirms that using both security groups (C) and endpoint policies (D) is the intended approach.

Source: AWS Documentation, VPC User Guide, "Control access to services using VPC endpoints".

2. AWS Documentation: Endpoint policies. This page details how to use endpoint policies to control access by IAM principal. It provides examples of policies using the Principal element to specify allowed IAM user and role ARNs, directly supporting Option D.

Source: AWS Documentation, VPC User Guide, "Endpoint policies".

3. AWS Documentation: Security groups for interface endpoints. This section explains how security groups function with interface endpoints: "The security group rules determine the traffic that is allowed to and from the resources in your VPC that are associated with the security group." This supports using security groups to control access from specific EC2 instances (Option C).

Source: AWS Documentation, VPC User Guide, "Interface endpoints", section "Security groups for interface endpoints".