The company wants to fine-tune an ML model on Amazon Bedrock using sensitive data stored in private databases within a VPC, ensuring the data remains within its private network. AWS PrivateLink provides a secure, private connection between a VPC and AWS services like Amazon Bedrock, allowing data to stay within the company’s network without traversing the public internet. This meets the requirement for maintaining data privacy during fine-tuning.

Exact Extract from AWS AI Documents:

From the AWS Bedrock User Guide:

"AWS PrivateLink enables you to securely connect your VPC to Amazon Bedrock without exposing data to the public internet. This is particularly useful for fine-tuning models with sensitive data, as it ensures that data remains within your private network."

(Source: AWS Bedrock User Guide, Security and Networking)

Detailed Explanation:

Option A: Restrict access to Amazon Bedrock by using an AWS Identity and Access Management (IAM) service role.While IAM service roles control access to Amazon Bedrock, they do not address the requirement of keeping data within the private network during data transfer. This option is insufficient.

Option B: Restrict access to Amazon Bedrock by using an AWS Identity and Access Management (IAM) resource policy.IAM resource policies define permissions for Bedrock resources but do not ensure that data stays within the private network. This option is incorrect.

Option C: Use AWS PrivateLink to connect the VPC and Amazon Bedrock.This is the correct answer. AWS PrivateLink creates a secure, private connection between the VPC and Amazon Bedrock, ensuring that sensitive data does not leave the private network during fine-tuning, as required.

Option D: Use AWS Key Management Service (AWS KMS) keys to encrypt the data.While AWS KMS can encrypt data, encryption alone does not guarantee that data remains within the private network during transfer. This option does not fully meet the requirement.