Amazon MLS-C01: Security, Privacy & Compliance — Study Guide
Part of the AWS Machine Learning Specialty MLS-C01 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
Data and model encryption: layered controls and common pitfalls
Encrypting data at rest and in transit is the first line of defense for ML pipelines. For objects in S3 prefer server-side encryption with KMS (SSE-KMS) when you need auditability and granular key control; SSE-S3 is acceptable for buckets where per-request KMS logging is unnecessary. SageMaker model artifacts, EBS volumes attached to training and hosting instances, and EFS/FSx volumes must also be encrypted—SageMaker can be configured to use customer-managed CMKs for model artifact and volume encryption. For large datasets or cross-account sharing, use envelope encryption (generate data keys with KMS and use the AWS Encryption SDK or client-side libraries) to avoid repeated KMS calls. In-transit protection requires TLS for all S3 and service endpoints; when using private networking, PrivateLink and VPC endpoints still use TLS on the wire. A frequent trap is forgetting to update CMK key policies: granting the SageMaker service principal and your execution roles decrypt/generate permissions is required (IAM alone is not sufficient). Decision criteria: choose AWS-managed CMKs when you want low operational overhead; choose customer-managed CMKs when you require key rotation policies, cross-account control, or separated key administrators. Consider performance and cost: envelope encryption reduces KMS API usage for high-throughput workloads.
Key management, CMK design and operational controls
Designing a KMS strategy for ML workloads balances security, access boundaries, and operations. Use customer-managed CMKs when you need fine-grained policy controls, grants, cross-account use, and audit trails in CloudTrail for GenerateDataKey/Decrypt operations. For HSM-backed keys and FIPS requirements, consider a KMS Custom Key Store backed by CloudHSM. Key policies are authoritative; complement them with IAM policies and use kms:ViaService conditions to limit usage to specific AWS services (for example, allow decrypt only when called via sagemaker.amazonaws.com or s3.amazonaws.com). Use KMS grants for short-term permissions to delegate decrypt/encrypt to ephemeral roles used by training jobs. Enable automatic key rotation for symmetric CMKs where appropriate and create multi-region keys for geo-redundant model replication. Common traps include relying solely on IAM policies (without updating the CMK key policy), and forgetting to include service principals (such as sagemaker.amazonaws.com or elasticblockstore.amazonaws.com) so managed services can use CMKs. Decision criteria should weigh administrative separation (use distinct CMKs per business unit or sensitivity class) against KMS quota and operational complexity; apply the principle of least privilege and audit GenerateDataKey events in CloudTrail.
Private networking and VPC endpoints for SageMaker and S3
To keep data and images off the public internet, place SageMaker Studio, notebook instances, and training/hosting jobs into VPCs and use VPC endpoints. S3 Gateway Endpoints allow direct, private access to bucket objects from your subnets; attach restrictive endpoint policies to limit access to specific buckets and prefixes. SageMaker APIs, runtime calls, and ECR require Interface Endpoints (PrivateLink): create com.amazonaws.
IAM, private image access, audit logging and exfiltration controls
Least-privilege IAM roles are central: the SageMaker execution role must have only the S3, ECR, KMS, and CloudWatch permissions necessary for the job, often scoped to resource ARNs and constrained with aws:SourceArn/aws:SourceAccount/aws:SourceVpc conditions. For private container images, host them in private ECR repositories with repository policies that restrict pulls to specific IAM principals or organizational accounts; mark images immutable and enable image scanning. Audit logging is comprehensive: enable CloudTrail management and S3 data events for GetObject/PutObject on sensitive buckets, forward logs to a dedicated, encrypted, cross-account logging bucket, and enable CloudWatch Logs and VPC Flow Logs to detect anomalous egress. Use Amazon Macie to discover PII in S3 and GuardDuty to detect unusual data-access patterns. To prevent data exfiltration, combine S3 bucket policies that Deny requests not originating from approved VPC endpoints or VPC CIDRs, network controls such as Security Groups/NACLs and AWS Network Firewall for egress filtering, and IAM permission boundaries/SCPs to reduce blast radius. Common traps include assuming that VpcConfig alone prevents all outbound egress (you must control NAT/Internet Gateway and endpoints) and forgetting to grant KMS decrypt to the actual runtime principals that need model artifacts.
Practical Problem: Use-Case Scenario
Scenario: MetroDelivery operates per-city XGBoost models stored as artifacts in S3 and trains models in SageMaker Studio. They require that training and inference never traverse the public internet, model artifacts are encrypted with customer-controlled keys, and container images are hosted privately.
Challenge: Ensure end-to-end encryption and private networking for training and hosting, restrict image pulls to approved roles, and detect/prevent unauthorized data movement.
Recommended Approach:
- Create a customer-managed symmetric CMK in KMS, set a key policy granting MetroDelivery admins, sagemaker.amazonaws.com, and the SageMaker execution roles Decrypt/GenerateDataKey permissions, and enable automatic rotation.
- Encrypt S3 buckets with SSE-KMS using that CMK; use S3 bucket policies to block public access and require aws:SourceVpc or aws:ViaAWSService conditions for PutObject/GetObject.
- Configure VPC: deploy private subnets without NAT, create a Gateway VPC Endpoint for S3 with an endpoint policy limited to the model bucket prefix, and deploy Interface Endpoints for sagemaker, sagemaker-runtime, ecr.api, ecr.dkr, sts, and cloudwatchlogs.
- Host images in private ECR with repository policy restricting principals to the SageMaker execution role; enable image immutability and scanning. Enable CloudTrail (management + S3 data events), Macie for sensitive data discovery, and GuardDuty for anomalous activity; send logs to an encrypted cross-account audit bucket.
Rationale: Using a customer-managed CMK provides control and auditability for model artifacts; VPC endpoints and restrictive endpoint/repo policies keep traffic on the AWS network and prevent public egress; combined logging and data-classification services detect and deter exfiltration while least-privilege IAM limits attack scope.
← Deployment · All domains · MLOps →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →