Exam AWS Certified Machine Learning Engineer - Associate MLA-C01 topic 1 question 108 discussion

VPN - predefined IP range

✅ Explanation: Context: The company is using Amazon SageMaker Studio notebooks. Access is allowed through a VPN, meaning users are coming from known, fixed IP ranges. The concern is unauthorized access via presigned URLs, which could potentially be used outside the trusted network. ✅ Why aws:sourceIp is the right choice: The aws:sourceIp condition in IAM policies allows you to restrict access based on the client's IP address. This is perfect for VPN-based setups where you know the IP range. It ensures that only users accessing from allowed IPs (e.g., your VPN subnet) can access SageMaker Studio resources, even if they have a valid presigned URL. This directly mitigates the risk of URL misuse from outside the VPN.

A is correct. https://aws.amazon.com/blogs/machine-learning/secure-amazon-sagemaker-studio-presigned-urls-part-1-foundational-infrastructure/ Studio supports a few methods for enforcing access controls against presigned URL data exfiltration: Client IP validation using the IAM policy condition aws:sourceIp Client VPC validation using the IAM condition aws:sourceVpc Client VPC endpoint validation using the IAM policy condition aws:sourceVpce

If you apply IP restrictions, it may not be possible to properly control access via dynamic IP addresses or proxies, so the correct answer is probably B.