Networking architecture

Enterprise ML platforms built on AWS normally have requirements to access on-premises resources, such as on-premises code repositories or databases. Secure communications such as AWS Direct Connect or VPN should be established. To enable flexible network routing across different AWS accounts and the on-prem network, consider using the AWS Transit Gateway service. If you want all internet traffic to go through your corporate network, configure an internet egress route to allow internet traffic to go through the on-premises network. The following figure shows a network design with multiple accounts and an on-premises environment.

Networking design

For enhanced network security, you can configure resources in different AWS accounts to communicate via the Amazon Virtual Private Cloud (VPC) using VPC endpoints. A VPC endpoint enables private connections between your VPC and supported AWS services. There are different types of VPC endpoints such as interface endpoint and gateway endpoint. An interface endpoint is an elastic network interface (ENI) with a private IP address from the IP address range of your subnet that you can control network access using a VPC security group. To access resources inside a VPC, you need to establish a route to the subnet where your interface endpoint is located. A gateway endpoint is a gateway that you specify as a target for a route in your route table. You can control access to resources behind a VPC endpoint using a VPC endpoint policy.

For data scientists to use Amazon SageMaker, AWS recommend the following VPC endpoints:

• Amazon S3

• Amazon SageMaker (to call SageMaker APIs)

• Amazon SageMaker Runtime (only use this in accounts which have permissions to invoke SageMaker endpoints)

• Amazon SageMaker Feature Store Runtime

• Amazon Security Token Service (STS)

• Amazon CloudWatch (for logging)

• AWS CloudTrail (for auditing API calls made by the service)

• Amazon Elastic Container Registry (ECR)

• AWS CodePipeline

• AWS CodeBuild

• AWS CodeArtifact

The following figure shows the networking architecture for SageMaker with private endpoints for all the dependent services.

Networking architecture for Amazon SageMaker Studio inside a VPC (Not all VPC endpoints are shown for simplicity)