Yesterday was permissions: "who can do what." Today is networking: "where does traffic flow." By default, SageMaker training and inference containers run in AWS-managed networks and can reach the internet. In sensitive or regulated environments, this must be blocked. Today you learn VPC mode, internet blocking, VPC Endpoints (PrivateLink), and security groups to isolate SageMaker.
By default, SageMaker training jobs run in AWS-managed, isolated networks with optional internet access