c2.4 Run customization privately in a VPC with no internet

Keep training inside your network

A customization job downloads your training data and uploads metrics and the resulting model. By default that traffic can traverse the public AWS service path. Attaching a VPC configuration to the job pins all of that data movement to elastic network interfaces inside your VPC, so training data never leaves a network boundary you control. Combined with a VPC that has no internet route, the job can reach your S3 data only through a VPC endpoint — there is no path to the public internet to exfiltrate data over.

Give the job private subnets and a security group

Provide the customization job with a vpcConfig listing private subnets (two or more, in different AZs for redundancy) and a security group:

{
  "vpcConfig": {
    "subnetIds": ["subnet-0aaa1111", "subnet-0bbb2222"],
    "securityGroupIds": ["sg-0ccc3333"]
  }
}

Pass this as the --vpc-config parameter to create-model-customization-job. The subnets do not need a NAT gateway or internet access — all traffic exits through VPC endpoints.

Add an S3 endpoint so the job can reach its data

With no internet route, create an S3 gateway VPC endpoint in the VPC so the job can read training/validation data and write output privately. Lock it down with an endpoint policy that allows only the specific buckets involved:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::my-bedrock-training-data",
        "arn:aws:s3:::my-bedrock-training-data/*",
        "arn:aws:s3:::my-bedrock-custom-output",
        "arn:aws:s3:::my-bedrock-custom-output/*"
      ]
    }
  ]
}

Tie the network to the identity

Pair this with the customization service role (least-privilege) and the CMK control so the job is constrained on all three axes: who (role), what key (CMK), and which network path (VPC + S3 endpoint). A leaked role credential used from outside the VPC then has no route to the data.

Naming note: replace subnet, security-group, and bucket identifiers. Use private subnets with no internet gateway; verify the route table has no 0.0.0.0/0 route.