Exams / AIP-C01 / Study guide / Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation)
Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation): AIP-C01 study notes and practice questions
What to know about Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation) for the AIP-C01 exam, from the AI Safety, Security, and Governance domain (20% of the exam guide), then 2 free questions to test it. Part of the AIP-C01 study guide.
AIP-C01 asks how to keep prompts, retrieved documents and model calls on a private network, and how to limit access to them. The exam separates network paths (endpoints, VPC placement) from permissions (IAM, endpoint policies, Lake Formation) and from encryption keys.
Private model access
An interface VPC endpoint for Amazon Bedrock uses AWS PrivateLink, so calls from your VPC reach the service over the AWS network rather than the internet. Place the endpoint in private subnets and use a security group that allows HTTPS from your application. An endpoint policy then restricts which principals and model resources can be used through that endpoint. See Bedrock interface endpoints.
A NAT gateway does not solve this. Traffic through NAT still leaves the VPC for the public Bedrock endpoint.
Protecting RAG data
S3 source buckets can use a bucket policy that allows access only from the VPC endpoint, with an aws:SourceVpce condition.
Lake Formation grants column-level and row-level permissions on data lake tables. When the job that exports data for retrieval runs under a role limited by Lake Formation, restricted columns never reach the index.
Knowledge base encryption can use a customer managed KMS key, so your key policy controls who can decrypt the stored data.
Encryption and logs
Use customer managed KMS keys for knowledge base resources, S3 source data and CloudWatch log groups that hold model logs. The key policy and grants decide which roles can read the encrypted data, which adds a control beyond IAM on the bucket.
Agent placement
AgentCore Runtime can run an agent in your VPC, so tool calls reach private databases, internal APIs or private services without public endpoints. Pair this with security groups and scoped IAM roles for each tool.
Monitoring access
CloudTrail records API calls to Bedrock and to data services, and CloudWatch alarms on unusual access patterns. VPC flow logs show network-level traffic. These support the audit requirement, but they do not hide the data, so use them with the controls above.
How to choose
Scenario wording
Choose
“Bedrock traffic must not cross the internet”
Interface VPC endpoint (PrivateLink) with private subnets
“Only approved models may be used from this VPC”
Endpoint policy plus an IAM condition on the model
“Some teams must not see certain columns in RAG source data”
Lake Formation column and row permissions
“The company must hold the encryption keys”
Customer managed KMS key with a restrictive key policy
“The agent must reach a private database”
AgentCore Runtime in a VPC
Common traps
Using NAT or a public subnet and calling the path private.
Confusing security groups with endpoint policies. Security groups control network paths; endpoint policies control API actions and resources.
Restricting an S3 bucket with IAM only and not with a VPC endpoint condition.
Assuming CloudTrail records prompt content. It records API calls. Invocation logging records content.
Expecting Lake Formation to govern S3 files that are not registered in the Data Catalog.
A logistics startup runs a dispatch assistant in private subnets of its VPC. The subnets have no internet gateway and no NAT gateway, and the company's compliance rules forbid workload traffic from crossing the public internet.
The assistant calls a model on Amazon Bedrock to draft route summaries, and the security team wants those API calls to stay on the AWS network. Only the application's IAM role should be able to call Bedrock, and the model code cannot change.
The team needs a design that keeps Bedrock calls on private networking, adds the least cost, and exposes no public endpoint.
Which solution meets these requirements?
Choose one answer.
AA. Attach a NAT gateway in a public subnet, and restrict the application's security group to the published Bedrock IP address ranges, so that only Bedrock traffic leaves the VPC.
BB. Create an interface VPC endpoint for the Bedrock runtime API in the private subnets with private DNS enabled, and allow HTTPS to it from the application's security group.
CC. Connect the VPC to the corporate data center with a site-to-site VPN, and send the Bedrock calls through the data center's internet connection to the public Bedrock endpoint.
DD. Move the dispatch assistant into a public subnet with an internet gateway, and rely on TLS encryption and an API key to protect the Bedrock calls while they are in transit.
Show the answer and explanation
Answer: B
A. Wrong: A NAT gateway still sends the calls over the public internet, which the compliance rule forbids, and the published IP ranges change over time. The design also adds an hourly and per-gigabyte NAT charge.
C. Wrong: The VPN adds hardware, routing and recurring cost, and the calls still reach the public Bedrock endpoint over the internet. It meets none of the stated requirements and adds another path to maintain.
D. Wrong: TLS encrypts the traffic, but the calls still cross the public internet, and the rule covers the network path as well as the content. A public subnet also exposes the workload to inbound traffic the team does not need.
Explanation
An interface VPC endpoint powered by AWS PrivateLink gives the private subnets a private path to Bedrock, so no traffic crosses the internet and no gateway or public IP is needed. NAT, VPN and public subnet designs all send the calls over the public internet, which the compliance rule forbids.
With private DNS, the Bedrock runtime name resolves to the endpoint, and the security group only needs to allow HTTPS to it.
A cable broadband provider runs a billing dispute agent built with an open-source agent framework on Amazon Bedrock AgentCore. The agent answers customer questions by calling tools that read invoices and payment history.
The invoice and payment data sit in an Amazon Aurora PostgreSQL cluster in private subnets of the provider's VPC. The security team forbids any public endpoint for that database, so the tools must reach the cluster without exposing it to the internet.
The design must keep the data path private end to end, use IAM for access to the tools, and reuse the tool code that is already written as AWS Lambda functions.
Which solution meets these requirements?
Choose one answer.
AA. Enable public access on the Aurora cluster, restrict its security group to the AgentCore service IP address ranges, and require a database password stored in AWS Secrets Manager for every query.
BB. Place the tool Lambda functions in private subnets of the VPC with access to the database port, register them in AgentCore Gateway, and let the gateway invoke them with IAM.
CC. Export the invoice and payment tables to a public Amazon S3 bucket each night, so that the agent reads the files directly and never connects to the database.
DD. Keep the tool Lambda functions outside the VPC, connect them to Aurora over its public endpoint with IAM database authentication, and enforce TLS on every connection.
Show the answer and explanation
Answer: B
A. Wrong: A public endpoint is exactly what the security team forbids, even with a restricted security group and a stored password. The service IP ranges also change over time, so the allow list would need constant updates.
B. Right: The functions reach Aurora over private addresses, so the database never needs a public endpoint. AgentCore Gateway exposes the functions as tools and invokes them with IAM, so the agent's identity controls access. Learn more: Amazon Bedrock AgentCore Gateway (opens in a new tab)
C. Wrong: A public bucket exposes customer invoices and payment history to the internet, which is a serious breach of the security requirement. Nightly copies also make the agent answer from stale data.
D. Wrong: IAM authentication and TLS protect the connection, but the traffic still uses a public endpoint, which the security team forbids. Moving the functions out of the VPC removes the private path that the requirement needs. Learn more: Giving Lambda access to resources in a VPC (opens in a new tab)
Explanation
Lambda functions in private subnets reach Aurora over private addresses, so the database needs no public endpoint. AgentCore Gateway exposes those functions as tools and invokes them with IAM. Public endpoints, public buckets and public connections all break the security rule, even when they are protected by passwords, IAM or TLS.
Want more on Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation)? The 5 full-length practice sets have 6 more Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation)