MLA-C01 Practice Question 60: IAM Condition VPC Enforcement
AWS Certified Machine Learning Engineer – Associate (MLA-C01) · Test 6 · question 10 of 10
A security engineer must ensure that data scientists can create SageMaker AI training jobs only in approved private subnets. The data scientists' role has one policy that allows sagemaker:CreateTrainingJob, and no other policy grants that action. The policy's condition is ForAllValues:StringEquals on sagemaker:VpcSubnets, listing the two approved subnet IDs. Testing shows that a job using an unapproved subnet is denied, as intended. However, a job created with no VpcConfig at all is allowed and runs outside the VPC.
How should the engineer fix the policy?
Show answer and explanation
Answer:
ForAllValues checks that *every* value of a multivalued key in the request is in the list. When the key is missing from the request, there are no values to fail the check, so the condition evaluates to true. A job with no VpcConfig has no sagemaker:VpcSubnets key, so the allow statement matches. AWS warns about exactly this with ForAllValues in Allow statements and recommends adding a Null condition set to false to require that the key is present. SageMaker AI's own example policy for forcing training jobs into a VPC pairs the two conditions the same way (option A).
- B is wrong because ForAnyValue needs only *one* approved subnet to match. It would deny the no-VPC case, but it would allow a job that lists one approved subnet alongside an unapproved one, opening a new gap. - C is wrong because sagemaker:VpcSubnets is a multivalued key, and AWS states that multivalued context keys require a set operator (ForAllValues or ForAnyValue) to compare against a list. A plain StringEquals is the wrong tool and does not reliably enforce the subnet rule. - D is wrong because network isolation controls a container's outbound network access. It has nothing to do with whether the job runs in approved subnets, and isolated jobs could still run outside the VPC.
Reference: Single-valued vs. multivalued context keys