GreenField Media runs SageMaker training and hosts models in the same AWS account. They require all training and hosting instances to be launched in specific private subnets and use security groups that restrict traffic to their internal analytics VPC only. Which SageMaker configuration change will correctly enforce use of the specified subnets and security groups for both training and endpoint hosting?

The VpcConfig parameter, which includes Subnets and SecurityGroupIds, must be explicitly provided when creating a SageMaker training job (CreateTrainingJob) and again when creating a model (CreateModel) and an endpoint configuration (CreateEndpointConfig). This ensures that both the training instances and the hosted model endpoints are launched within the specified private subnets and use the designated security groups, restricting traffic as required. SageMaker creates Elastic Network Interfaces (ENIs) in these specified subnets for secure communication. Attaching security groups to the SageMaker service principal is not a valid or supported configuration method for enforcing VPC settings on individual SageMaker resources. Setting an account-level default VPC does not automatically apply to SageMaker training or hosting instances; these require explicit VPC configuration. Configuring only the EndpointConfig is insufficient because training jobs would not inherit these settings and would run outside the desired private network.