How to Access Amazon Bedrock Privately Without Internet in a VPC?

AIF-C01 By islever Editorial Last updated

Short answer

A AWS PrivateLink

Question

A financial institution is using Amazon Bedrock to develop an AI application. The application is hosted in a VPC. To meet regulatory compliance standards, the VPC is not allowed access to any internet traffic. Which AWS service or feature will meet these requirements?
  1. AWS PrivateLink Correct Answer
  2. Amazon Macie
  3. Amazon CloudFront
  4. Internet gateway

Key Takeaways

This question tests your understanding of private AWS service access: AWS PrivateLink keeps traffic within the AWS network, unlike internet gateways or public endpoints.

Learn how AWS PrivateLink enables private, secure connectivity to Amazon Bedrock from a VPC with no internet access, a common compliance requirement. Community consensus confirms AWS PrivateLink is the correct answer for this AIF-C01 exam question.

Common mistake: Choosing an internet gateway, because it seems like the standard way to connect to AWS services, but it explicitly enables internet traffic, violating the VPC's no-internet requirement.

Expert Analysis

Why the Answer Is Correct

AWS PrivateLink allows you to access Amazon Bedrock through private endpoints inside the VPC, without any traffic traversing the public internet. This meets the regulatory requirement of no internet access while enabling secure connectivity to the managed AI service. Multiple community comments (e.g., 6 likes, 4 likes) correctly highlight that PrivateLink is the only option that provides private, secure connectivity to AWS services without internet exposure.

Why the Other Options Are Wrong

Amazon Macie is a data security service, not a connectivity feature, so it does not provide network access to Bedrock. Amazon CloudFront is a CDN that delivers content over the public internet, which violates the no-internet restriction. An internet gateway is explicitly used to enable internet traffic from a VPC, making it completely contrary to the compliance constraint. Only AWS PrivateLink meets both the connectivity and security requirements.

Community Comment Notes

One comment (likes=1) noted that this question closely resembles a Solutions Architect exam topic, indicating the importance of understanding PrivateLink across AWS certifications. Another comment (likes=1) correctly explains that an internet gateway is for internet traffic, so it cannot be used in this scenario. The highest-voted comments consistently confirm that AWS PrivateLink is the right choice, with several providing clear explanations of why it ensures traffic stays within the private AWS network.

Exam Strategy

When you see a VPC with 'no internet access' and a need to connect to AWS services, always think AWS PrivateLink first. Eliminate any option that involves the public internet (e.g., CloudFront, internet gateway) or that is unrelated to connectivity (e.g., Macie).

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. tccusa 👍 6 Answered A
    Privatelink allows secure, private connectivity to aws services.
  2. Moon 👍 2 Answered A
    A: AWS PrivateLink Explanation: AWS PrivateLink is used to securely access AWS services from a VPC without exposing the traffic to the public internet. This ensures compliance with regulatory standards that prohibit internet access, as all communication happens over the private AWS network.
  3. 4974d0b 👍 1 Answered A
    The correct answer is: A. AWS PrivateLink Explanation: Since the VPC does not have internet access, the financial institution must use a private connectivity option to access Amazon Bedrock, which is a managed AI service. AWS PrivateLink allows private communication between VPCs and AWS services without requiring internet access, making it the best option for regulatory compliance. Amazon Macie (B): A data security service that helps identify sensitive data but does not provide private connectivity. Amazon CloudFront (C): A CDN service that optimizes content delivery but still requires internet access. Internet Gateway (D): This would provide internet access, which is explicitly not allowed per the requirements. Thus, AWS PrivateLink is the right solution to enable secure, private access to Amazon Bedrock within the VPC.
  4. Jessiii 👍 1 Answered A
    AWS PrivateLink allows secure and private connectivity to AWS services, such as Amazon Bedrock, without requiring internet access. It enables you to connect to Amazon Bedrock over a private link within your VPC, ensuring that traffic does not traverse the public internet, which is essential for meeting regulatory compliance standards that prohibit internet traffic.
  5. eesa 👍 1 Answered A
    AWS PrivateLink enables secure, private connectivity between Virtual Private Cloud (VPC) environments and AWS services without exposing traffic to the public internet
Show 3 more comments
  1. 85b5b55 👍 1 Answered A
    AWS PrivateLink is the right options to avoid the any internet traffic. IG for internet traffic so we can't use it for this usecase.
  2. CleyAWS 👍 1 Answered A
    Answer is A, but this is a question for Solutions Architect exam..
  3. MarvelousV 👍 1
    Comment

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to use a custom trained model in Amazon Bedrock?

S-grade

How to Increase Image Specificity in Amazon Bedrock Stable Diffusion?

S-grade

How to Quickly Deploy and Consume Foundation Models in a VPC on AWS?

S-grade

Which AWS Service Sends Email Notifications When ISV Compliance Reports Are Available?

S-grade

Practice All AIF-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AIF-C01 Practice Test →

← Back to AIF-C01 Study Guide