A company wants to fine-tune a model hosted on Amazon Bedrock using sensitive data stored in private databases inside a VPC. The data must remain within the company’s private network. Which option satisfies this requirement?

AWS PrivateLink allows you to establish private connectivity between your VPCs and services hosted on AWS, like Amazon Bedrock, without exposing your data to the public internet. This ensures that sensitive data remains within your private network while fine-tuning the model. IAM service roles and resource policies control access permissions but do not create private network connections, meaning data would still traverse the public internet. AWS KMS encrypts data at rest and in transit but does not address the requirement of keeping data entirely within the private network during the connection to Bedrock.