Data scientists use Amazon SageMaker instances and APIs inside a VPC that has no internet access. Training datasets are in Amazon S3 and accessed via interface VPC endpoints for S3 and SageMaker APIs. Occasionally the team needs access to the public Python Package Index (PyPI) to update packages. The SageMaker instances must remain isolated from the internet. Which solution provides PyPI access while keeping the VPC isolated?

The correct solution involves AWS CodeArtifact because it allows you to securely pull packages from public repositories like PyPI into a private repository within your AWS environment. By creating a CodeArtifact domain and repository with an external connection to public:pypi, SageMaker instances can access necessary packages without direct internet exposure. A VPC endpoint for CodeArtifact ensures all traffic remains within the AWS network, maintaining the VPC's isolation. The other options are incorrect because: Creating CodeCommit repositories for each package is impractical and doesn't provide a direct PyPI mirror. NAT gateways and NAT instances provide internet access, which violates the requirement for the VPC to remain isolated from the internet. Even with restrictive network ACLs or firewall rules, the underlying mechanism still involves direct internet connectivity, which is precisely what the problem statement aims to avoid for the VPC.