A Machine Learning Specialist is using an Amazon SageMaker notebook instance in a private subnet of a corporate VPC. The ML Specialist has important data stored on the Amazon SageMaker notebook instance's Amazon EBS volume, and needs to take a snapshot of that EBS volume. However, the ML Specialist cannot find the Amazon SageMaker notebook instance's EBS volume or Amazon EC2 instance within the VPC. Why is the ML Specialist not seeing the instance visible in the VPC?
Show Answer & Explanation
Correct Answer: C. Amazon SageMaker notebook instances are based on EC2 instances running within AWS service accounts.
Amazon SageMaker notebook instances are based on EC2 instances that run within AWS service accounts, not customer accounts. This is why the ML Specialist cannot see the notebook instance or its EBS volume in their own VPC—the underlying EC2 infrastructure is managed by AWS in a separate service account. While the notebook instance appears as a resource in the customer's SageMaker console and can access resources in the customer's VPC (via ENI attachment or other mechanisms), the actual compute instance itself exists outside the customer's account. This architecture allows AWS to manage the infrastructure, apply patches, and handle backups without exposing these details to the customer. To snapshot the EBS volume, the Specialist should use SageMaker's native snapshot or export features, not EC2 console actions. Why correct: SageMaker notebook instances are managed services running in AWS accounts EC2 instance is in an AWS service account, not customer account This explains why it's not visible in customer's VPC/EC2 console Aligns with AWS managed service architecture pattern Why others are incorrect: A (Outside VPCs): Incorrect—SageMaker instances do interact with customer VPCs, but underlying EC2 is in service account B (Based on ECS): Incorrect—SageMaker uses EC2, not ECS D (ECS in service accounts): Doubly incorrect—uses ECS instead of EC2, and while service account part is correct