Skill 4.3.2: Configure least privilege access to ML and AI artifacts

Question	Answer & Explanation
### Question 1 - SageMaker Notebook Access to S3 Training Data A machine learning engineering team is setting up an environment for a new project using Amazon SageMaker Notebooks. The notebooks must read raw training datasets stored in a specific Amazon S3 bucket and write processed data back to a different prefix in the same bucket. The security team mandates that the solution follows the principle of least privilege and prohibits the use of long-lived credentials. Which approach satisfies these requirements with the least operational overhead? - A) Attach the `AmazonS3FullAccess` managed policy to the IAM user account that the data scientists use to log in to the SageMaker domain. - B) Create an IAM execution role for the SageMaker notebook instance with a custom policy allowing `s3:GetObject` on the input data prefix and `s3:PutObject` on the output data prefix. - C) Generate a pair of long-term AWS access keys for an IAM user and store them in the notebook's `.bashrc` file to be used by the processing scripts. - D) Configure a public-read and public-write bucket policy on the specific S3 bucket so the notebook can access the data without needing IAM credentials.	Correct Answer: B Correct Answer Analysis: - B is Correct: Attaching a custom IAM execution role to the SageMaker notebook allows the notebook to assume temporary, automatically rotated credentials. Scoping the `s3:GetObject` and `s3:PutObject` actions to only the specific input and output prefixes adheres strictly to the principle of least privilege. Distractor Analysis: - A is Incorrect: `AmazonS3FullAccess` grants permissions to all S3 buckets and objects in the account, which violates the least privilege requirement. Attaching policies to IAM users rather than roles is also an anti-pattern for AWS service access. - C is Incorrect: Embedding long-term access keys in configuration files is a severe security risk and explicitly violates the constraint prohibiting long-lived credentials. - D is Incorrect: Making an S3 bucket public is a massive security vulnerability and violates standard data security compliance for enterprise ML workloads. > Exam Tip / AWS Best Practice: Always use IAM roles for AWS service interactions (like SageMaker Notebooks) and scope S3 permissions down to specific bucket ARNs and prefixes.
### Question 2 - Securely Writing Model Artifacts from a Training Job A data science team is launching an Amazon SageMaker Training Job that will train a custom XGBoost model. The training job needs to read training data from an S3 bucket and write the resulting model artifacts to another S3 bucket. The DevOps team mandates least privilege access for all training jobs and strict separation of data read/write permissions. Which configuration will successfully complete the training job while adhering to the security constraints? - A) Attach the `AmazonS3ReadOnlyAccess` policy to the SageMaker execution role, and pre-create the `model.tar.gz` file manually in the output S3 bucket. - B) Create an inline IAM policy allowing `s3:GetObject` on the input S3 bucket ARN and `s3:PutObject` on the output S3 bucket ARN. Attach this policy to the SageMaker execution role passed to the training job. - C) Configure an S3 bucket policy on the output bucket allowing `s3:PutObject` for the AWS account root user, and run the training job with the root account credentials. - D) Create an IAM policy with `s3:ListBucket` and `s3:GetObject` on all buckets in the account, and attach it to the SageMaker execution role.	Correct Answer: B Correct Answer Analysis: - B is Correct: The SageMaker training job requires permissions to read the input data (`s3:GetObject`) and write the resulting model artifacts (`s3:PutObject`). Scoping these permissions specifically to the input and output bucket ARNs follows the principle of least privilege. Distractor Analysis: - A is Incorrect: While `AmazonS3ReadOnlyAccess` allows reading the data, it does not grant the `s3:PutObject` permission required for the training job to write the model artifacts to the output S3 bucket. - C is Incorrect: Using root account credentials is a major security anti-pattern. Additionally, S3 bucket policies alone do not grant identity-based permissions to the SageMaker execution role. - D is Incorrect: Granting `s3:GetObject` on all buckets in the account violates the least privilege constraint. Furthermore, it omits the `s3:PutObject` permission needed to write the model artifacts. > Exam Tip / AWS Best Practice: SageMaker Training Jobs need an execution role with specific read permissions for input channels and write permissions for the output data location (model artifacts).
### Question 3 - Least Privilege for Invoking an Amazon Bedrock Model An enterprise application running on Amazon EC2 needs to generate marketing copy using the `anthropic.claude-3-sonnet` foundation model via Amazon Bedrock. The company's security policy requires that the application's IAM role is configured with least privilege and can only invoke this specific foundation model. Which IAM policy statement will meet these requirements? - A) Allow `bedrock:InvokeModel` on resource `"arn:aws:bedrock:::foundation-model/"`. - B) Allow `bedrock:InvokeModel` on resource `"arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-sonnet"`. - C) Allow `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream` on resource `""`. - D) Allow `bedrock:` on resource `"arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-sonnet"`.	Correct Answer: B Correct Answer Analysis: - B is Correct: This policy statement grants exactly the required permission (`bedrock:InvokeModel`) and restricts access solely to the specific model ARN (`anthropic.claude-3-sonnet` in `us-east-1`), adhering perfectly to the principle of least privilege. Distractor Analysis: - A is Incorrect: Using a wildcard (``) for the foundation model ID allows the EC2 instance to invoke any* available Bedrock foundation model, which violates the least privilege constraint. - C is Incorrect: Allowing `InvokeModelWithResponseStream` is unnecessary if the application only requires standard synchronous invocation. Using `""` as the resource is an over-grant of permissions. - D is Incorrect:* Granting `bedrock:` allows the application to perform administrative actions like creating custom models or deleting provisioned throughput, drastically violating least privilege. > Exam Tip / AWS Best Practice:* Scope Bedrock model invocations down to the exact model ARN to prevent applications from inadvertently or maliciously accessing unauthorized, more expensive, or less guarded models.
### Question 4 - Encrypting and Securing Model Artifacts in S3 A financial services company stores trained ML model artifacts in an Amazon S3 bucket. Compliance policies mandate that the artifacts must be encrypted using a customer-managed key in AWS KMS. Furthermore, data scientists must be able to download and evaluate the models but must not be permitted to delete any artifacts. Which combination of configurations provides the required security and least privilege? (Select TWO) - A) Enable SSE-KMS encryption on the S3 bucket using the default AWS managed key (`aws/s3`). - B) Enable SSE-KMS encryption on the S3 bucket using a customer-managed key (CMK). - C) Grant the data scientists' IAM group `s3:GetObject`, `s3:PutObject`, and `s3:DeleteObject` permissions. - D) Grant the data scientists' IAM group `s3:GetObject` and `kms:Decrypt` permissions scoped to the S3 bucket and the CMK. - E) Create an S3 bucket policy that grants `s3:GetObject` to the public for auditing purposes.	Correct Answers: B and D Correct Answer Analysis: - B is Correct: Compliance explicitly requires the use of a customer-managed key (CMK) for SSE-KMS encryption, not the default AWS managed key. - D is Correct: To read the encrypted model artifacts, the data scientists need `s3:GetObject` on the bucket and `kms:Decrypt` on the CMK. By omitting `s3:DeleteObject`, they are prevented from deleting artifacts, satisfying the least privilege and operational constraints. Distractor Analysis: - A is Incorrect: While SSE-KMS is used, relying on the AWS managed key does not fulfill the compliance mandate requiring a customer-managed key. - C is Incorrect: Granting `s3:DeleteObject` directly violates the constraint that data scientists must not be able to delete artifacts. - E is Incorrect: Public read access is a severe security vulnerability and violates standard enterprise security compliance for proprietary model artifacts. > Exam Tip / AWS Best Practice: When using SSE-KMS with CMKs, users need both S3 read permissions and KMS decrypt permissions. To prevent deletion, simply omit the `s3:DeleteObject` action from the IAM policy.
### Question 5 - Secure Database Access in SageMaker Pipelines An Amazon SageMaker Pipeline includes a processing step that needs to connect to an Amazon RDS PostgreSQL database to extract feature data. The database credentials are stored securely in AWS Secrets Manager. The pipeline must be configured with least privilege access to retrieve the credentials. How should the ML engineer configure the pipeline to securely access the database credentials without over-provisioning permissions? - A) Attach the `SecretsManagerReadWrite` AWS managed policy to the SageMaker pipeline execution role. - B) Create an inline policy for the pipeline execution role allowing `secretsmanager:GetSecretValue` exclusively on the ARN of the specific database secret. - C) Hardcode the database username and password directly into the SageMaker Processing script's Python code. - D) Store the database credentials as environment variables in the SageMaker Pipeline definition JSON.	Correct Answer: B Correct Answer Analysis: - B is Correct: Using an inline policy with `secretsmanager:GetSecretValue` restricted to the specific secret ARN ensures the pipeline can only read the exact credential it needs, adhering strictly to least privilege. The pipeline runtime role will assume these permissions to fetch the secret dynamically. Distractor Analysis: - A is Incorrect: `SecretsManagerReadWrite` grants read and write access to all secrets in the account, which is a massive over-provisioning of privileges and violates least privilege. - C is Incorrect: Hardcoding credentials in scripts is a severe security anti-pattern that exposes sensitive data in source control and image layers. - D is Incorrect: Storing credentials as plaintext environment variables in the pipeline definition JSON is insecure and does not utilize AWS Secrets Manager as required. > Exam Tip / AWS Best Practice: For workloads needing secrets, scope the IAM role's `secretsmanager:GetSecretValue` permission down to the exact Secret ARN. Never use broad Secrets Manager managed policies.
### Question 6 - Restricting User Access to Specific S3 Buckets in SageMaker Studio A company has deployed an Amazon SageMaker Studio domain shared by multiple ML teams. Team A and Team B must have their own isolated spaces to read and write ML artifacts, and must not be able to access each other's S3 buckets. The administrator wants to apply least privilege with the lowest operational overhead. How can the administrator enforce this isolation? - A) Create a single IAM execution role for the SageMaker Studio domain with `AmazonS3FullAccess`. Rely on users to only navigate to their own buckets. - B) Configure separate IAM execution roles for Team A and Team B. Attach policies to each role that restrict S3 actions (like `s3:GetObject` and `s3:PutObject`) to their respective bucket ARNs. - C) Create an AWS Organizations Service Control Policy (SCP) that denies all S3 actions, and manually grant exceptions per user. - D) Use Amazon Macie to monitor S3 access, and manually revoke access if a user from Team A queries Team B's bucket.	Correct Answer: B Correct Answer Analysis: - B is Correct: Assigning distinct IAM execution roles to each team within the SageMaker Studio domain, and scoping the S3 permissions in the IAM policies to specific bucket ARNs, provides native, secure isolation with minimal operational overhead. Distractor Analysis: - A is Incorrect: Granting `AmazonS3FullAccess` violates least privilege and relies on the honor system for isolation, which is not a valid security control. - C is Incorrect: While SCPs can restrict access, using them to deny all S3 actions and manually granting exceptions is highly operationally inefficient and breaks SageMaker's native integrations. - D is Incorrect: Amazon Macie is a data security and privacy service for discovering and protecting sensitive data, not an access control mechanism to prevent bucket access between teams. > Exam Tip / AWS Best Practice: In shared SageMaker Studio environments, use separate execution roles scoped to specific S3 bucket ARNs to enforce team-level data isolation natively via IAM.
### Question 7 - Managing Model Package Approval Permissions A machine learning team uses the Amazon SageMaker Model Registry to track model versions. A senior ML engineer is responsible for reviewing model evaluation reports and approving model packages for production deployment. To follow least privilege principles, the engineer should only have the ability to approve or reject model packages, and must not be able to delete them. Which IAM action should be granted to the senior ML engineer's role? - A) `sagemaker:UpdateModelPackage` - B) `sagemaker:DeleteModelPackage` - C) `sagemaker:CreateModelPackage` - D) `sagemaker:UpdateApprovalStatus` (Note: verify if this is a real action or a distractor) -> Wait, the correct action in SageMaker for approving a model package is `sagemaker:UpdateModelPackage` which updates the `ApprovalStatus`. Let's refine options. Revised Options: - A) Grant `sagemaker:UpdateModelPackage` on the specific Model Package ARNs. - B) Grant `sagemaker:DeleteModelPackage` on the Model Package Group ARNs. - C) Attach the `AmazonSageMakerFullAccess` managed policy to the engineer's role. - D) Grant `sagemaker:CreateModelPackage` on the Model Registry ARN.	Correct Answer: A Correct Answer Analysis: - A is Correct: The `sagemaker:UpdateModelPackage` API (and corresponding IAM permission) is used to change the status of a model package, including updating the `ApprovalStatus` to `Approved` or `PendingManualApproval`. Scoping it to specific ARNs adheres to least privilege. Distractor Analysis: - B is Incorrect: `sagemaker:DeleteModelPackage` would allow the engineer to delete the model artifacts from the registry, which explicitly violates the requirement. - C is Incorrect: `AmazonSageMakerFullAccess` grants comprehensive permissions including creation, deletion, and endpoint management, massively violating the least privilege constraint. - D is Incorrect: `sagemaker:CreateModelPackage` allows registering new models, which is a task for the CI/CD pipeline or the training role, not the approver role. > Exam Tip / AWS Best Practice: In SageMaker Model Registry, updating a model package's approval status requires the `sagemaker:UpdateModelPackage` permission. Scope it tightly to prevent unauthorized deletion or creation of packages.
### Question 8 - Endpoint Invocation Permissions for ECS Microservices A microservice running on Amazon ECS (Amazon Elastic Container Service) is designed to query an Amazon SageMaker real-time endpoint to get predictions. The security team mandates that the microservice's IAM role must be configured with least privilege to only invoke this specific endpoint, and explicitly must not have access to the S3 bucket containing the training data. Which IAM policy should be attached to the ECS task role? - A) Allow `sagemaker:InvokeEndpoint` on the endpoint ARN. Explicitly deny `s3:`. - B) Allow `sagemaker:InvokeEndpoint` on `""` and `s3:GetObject` on the training data bucket ARN. - C) Attach the `AmazonSageMakerFullAccess` policy to grant endpoint access. - D) Allow `sagemaker:CreateEndpoint` and `sagemaker:InvokeEndpoint` on the endpoint ARN.	Correct Answer: A Correct Answer Analysis: - A is Correct: This policy explicitly grants the only required action (`sagemaker:InvokeEndpoint`) and restricts it to the exact endpoint ARN. Adding an explicit deny for S3 ensures the microservice cannot inadvertently read the training data, perfectly matching the security constraints. Distractor Analysis: - B is Incorrect: Granting `sagemaker:InvokeEndpoint` on `""` violates least privilege by allowing invocation of any endpoint in the account. Granting S3 read access violates the explicit constraint prohibiting S3 access. - C is Incorrect:* `AmazonSageMakerFullAccess` provides administrative control over SageMaker resources, allowing the microservice to delete endpoints or create new ones, which is a massive security risk. - D is Incorrect: `sagemaker:CreateEndpoint` is an administrative control plane action. A microservice only needs the data plane action `InvokeEndpoint`. Granting create permissions violates least privilege. > Exam Tip / AWS Best Practice: Separate control plane (Create/Delete Endpoint) and data plane (InvokeEndpoint) permissions. Inference applications only need data plane permissions scoped to the specific endpoint ARN.
### Question 9 - Securely Sharing Model Artifacts with a Partner Account Your company has trained a proprietary ML model and stored the artifacts as `model.tar.gz` in an Amazon S3 bucket. You need to securely share these artifacts with a partner company's AWS account. The partner must only be able to download that specific `model.tar.gz` file and must not be able to access any other objects in the bucket or list the bucket's contents. The solution must require the least operational overhead. Which approach meets these security requirements? - A) Make the S3 bucket public and send the partner the direct HTTPS URL to the `model.tar.gz` object. - B) Create an S3 bucket policy granting `s3:GetObject` to the partner's AWS account root principal, scoped explicitly to the `model.tar.gz` object ARN. - C) Create an IAM user in your account for the partner, grant the user `s3:ListBucket` and `s3:GetObject` on the bucket, and provide the partner with long-term access keys. - D) Configure AWS DataSync to copy the `model.tar.gz` file to an S3 bucket in the partner's account.	Correct Answer: B Correct Answer Analysis: - B is Correct: An S3 bucket policy is the most operationally efficient way to grant cross-account access. By scoping the `s3:GetObject` action to the exact object ARN (`bucket-name/model.tar.gz`) and specifying the partner's account as the principal, the partner can only read that file. No `s3:ListBucket` permission is granted, so they cannot browse the bucket. Distractor Analysis: - A is Incorrect: Making a bucket public to share proprietary enterprise data is a severe security vulnerability and violates basic compliance standards. - C is Incorrect: Creating IAM users for external partners (cross-account access) is an anti-pattern. Sharing long-term access keys is insecure, and granting `s3:ListBucket` violates the requirement to prevent listing bucket contents. - D is Incorrect: Using AWS DataSync to copy the object introduces unnecessary operational overhead and requires setting up agent infrastructure, which is overkill for a simple file share. > Exam Tip / AWS Best Practice: For cross-account S3 access, use resource-based policies (S3 bucket policies) scoped to specific object ARNs. Avoid creating IAM users for external entities.
### Question 10 - Least Privilege Access for SageMaker Feature Store Online Retrieval A real-time fraud detection application uses Amazon SageMaker Feature Store to retrieve pre-computed features for a specific customer during inference. The application runs on AWS Lambda and connects to the Feature Store's online interface. The security team requires the Lambda execution role to have least privilege access, strictly limited to retrieving records from that specific feature group. Which set of permissions should be assigned to the Lambda execution role? - A) `sagemaker:DescribeFeatureGroup` and `sagemaker:GetRecord` on the specific Feature Group ARN. - B) `AmazonSageMakerFullAccess` managed policy. - C) `sagemaker:CreateFeatureGroup` and `sagemaker:UpdateFeatureGroup` on the specific Feature Group ARN. - D) `s3:GetObject` on the offline store S3 bucket backing the Feature Store.	Correct Answer: A Correct Answer Analysis: - A is Correct: The `sagemaker:GetRecord` API is the specific action required to retrieve a single record from the online store. Granting this along with `sagemaker:DescribeFeatureGroup` (often needed to resolve the online store connection details) strictly scoped to the specific Feature Group ARN represents true least privilege. Distractor Analysis: - B is Incorrect: `AmazonSageMakerFullAccess` grants administrative control to create, modify, and delete SageMaker resources, massively violating the least privilege constraint for an inference application. - C is Incorrect: `CreateFeatureGroup` and `UpdateFeatureGroup` are control plane administrative actions used by the data engineering pipeline, not the inference application. A Lambda function doing real-time retrieval should not have these permissions. - D is Incorrect: The online store for SageMaker Feature Store is backed by an online low-latency datastore (DynamoDB under the hood), not S3. Granting S3 access would not allow online retrieval and violates least privilege. > Exam Tip / AWS Best Practice: Inference applications querying SageMaker Feature Store online need data plane permissions (`sagemaker:GetRecord`), not control plane permissions (`CreateFeatureGroup`). Scope the IAM policy to the specific Feature Group ARN.