Accessing Amazon Bedrock Privately Without Internet

AIF-C01 By islever Editorial Last updated

Explain methods to secure AI systems.

Short answer

A AWS PrivateLink enables secure, private connectivity between the VPC and Amazon Bedrock without traversing the public internet, ensuring regulatory compliance.

Question

A financial institution is using Amazon Bedrock to develop an AI application. The application is hosted in a VPC. To meet regulatory compliance standards, the VPC is not allowed access to any internet traffic.
Which AWS service or feature will meet these requirements?
  1. AWS PrivateLink Correct Answer
  2. Amazon Macie
  3. Amazon CloudFront
  4. Internet gateway

Key Takeaways

The question tests the understanding of VPC endpoints; PrivateLink is the specific mechanism for private service access, whereas Internet Gateways enable public internet access.

Learn how to securely connect a VPC to Amazon Bedrock without internet access using AWS PrivateLink to meet strict regulatory compliance standards.

Common mistake: Candidates may incorrectly choose Internet Gateway if they confuse general VPC internet access with private service connectivity, failing to recognize that IG routes traffic to the public internet.

Expert Analysis

The governing principle here is network isolation for AWS managed services. The scenario requires accessing Amazon Bedrock from a VPC while strictly prohibiting any internet traffic to satisfy regulatory compliance.

AWS PrivateLink (Option A) creates a private interface endpoint within the customer's VPC, allowing traffic to flow directly to supported AWS services over the Amazon internal network. This ensures data never traverses the public internet, satisfying the strict connectivity constraint. Comments in the discussion correctly identify this as the standard solution for secure, private service access without internet exposure.

Amazon Macie (Option B) is a security service for discovering sensitive data and does not provide network routing or connectivity capabilities.

Amazon CloudFront (Option C) is a content delivery network designed to cache and distribute content globally via edge locations. It relies on the public internet infrastructure and cannot facilitate private VPC-to-service communication for Bedrock.

Internet Gateway (Option D) provides route targets for internet-bound traffic. Using an Internet Gateway would inherently allow internet access, which directly violates the requirement that the VPC is not allowed access to any internet traffic.

Therefore, AWS PrivateLink is the only architectural component that enables private connectivity to Bedrock while maintaining the required network isolation.

Official Reference

https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question specifies 'no internet' or 'private connectivity' to an AWS managed service, immediately eliminate Internet Gateways and NAT Gateways. Focus on VPC Interface Endpoints (PrivateLink) as the primary tool for private service access.

Frequently Asked Questions

Why can't I use an Internet Gateway to access Bedrock?

An Internet Gateway routes traffic to the public internet. Since the requirement prohibits all internet traffic, an IG violates the compliance constraint.

Does AWS PrivateLink support Amazon Bedrock?

Yes, AWS PrivateLink supports many AWS services including Bedrock, allowing private connectivity from your VPC to these services.

More AIF-C01 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. tccusa 👍 7 Answered A
    Privatelink allows secure, private connectivity to aws services.
  2. 4974d0b 👍 5 Answered A
    The correct answer is: A. AWS PrivateLink Explanation: Since the VPC does not have internet access, the financial institution must use a private connectivity option to access Amazon Bedrock, which is a managed AI service. AWS PrivateLink allows private communication between VPCs and AWS services without requiring internet access, making it the best option for regulatory compliance. Amazon Macie (B): A data security service that helps identify sensitive data but does not provide private connectivity. Amazon CloudFront (C): A CDN service that optimizes content delivery but still requires internet access. Internet Gateway (D): This would provide internet access, which is explicitly not allowed per the requirements. Thus, AWS PrivateLink is the right solution to enable secure, private access to Amazon Bedrock within the VPC.
  3. Moon 👍 3 Answered A
    A: AWS PrivateLink Explanation: AWS PrivateLink is used to securely access AWS services from a VPC without exposing the traffic to the public internet. This ensures compliance with regulatory standards that prohibit internet access, as all communication happens over the private AWS network.
  4. CleyAWS 👍 2 Answered A
    Answer is A, but this is a question for Solutions Architect exam..
  5. Jessiii 👍 1 Answered A
    AWS PrivateLink allows secure and private connectivity to AWS services, such as Amazon Bedrock, without requiring internet access. It enables you to connect to Amazon Bedrock over a private link within your VPC, ensuring that traffic does not traverse the public internet, which is essential for meeting regulatory compliance standards that prohibit internet traffic.
Show 6 more comments
  1. eesa 👍 1 Answered A
    AWS PrivateLink enables secure, private connectivity between Virtual Private Cloud (VPC) environments and AWS services without exposing traffic to the public internet
  2. VIJAY K T 👍 1 Answered A
    AWS PrivateLink enables private connectivity between a VPC and supported AWS services (including Amazon Bedrock) without traversing the public internet.
  3. 85b5b55 👍 1 Answered A
    AWS PrivateLink is the right options to avoid the any internet traffic. IG for internet traffic so we can't use it for this usecase.
  4. PrabhuPonnusamy 👍 1 Answered A
    Private link is an AWS Service which allows the multiple AWS services to connect privately
  5. ThinkCloud 👍 1 Answered A
    A is the correct answer.
  6. MarvelousV 👍 1
    Comment

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to use a custom trained model in Amazon Bedrock?

S-grade

How to Increase Image Specificity in Amazon Bedrock Stable Diffusion?

S-grade

How to Quickly Deploy and Consume Foundation Models in a VPC on AWS?

S-grade

Which AWS Service Sends Email Notifications When ISV Compliance Reports Are Available?

S-grade

Practice All AIF-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AIF-C01 Practice Test →

← Back to AIF-C01 Study Guide