Very nice! It’s true that you’ll need the NLB → ALB → Lambda with this approach, though if you were willing to call the SageMaker API from Apex in Salesforce, you can remove those and connect the VPC Endpoint directly to the SageMaker (com.amazonaws.REGION.sagemaker.api). That would be my advice…less moving parts, more serverless, less incremental cost, etc. And since you’re in the financial services space, I’ll also mention that the SF → AWS API traffic can be authenticated via certificates using IAM Roles Anywhere. Named Credentials has support for that as of February 2023.