Skip to content

Skill 4.3.3: Configure IAM policies and roles for users and applications in ML and AI systems

Question Answer & Explanation
### Question 1 - Selecting Production Credentials for Foundation Models



A financial services company is launching a production application on Amazon EC2 that invokes foundation models via the Amazon Bedrock API. Security policies mandate that the application must use the most secure credential approach with the lowest operational overhead and no long-term secrets stored on the instance.



Which credential approach satisfies these requirements? (Select ONE)



- A) Generate a long-term API key for Amazon Bedrock and store it in an environment variable on the EC2 instance.


- B) Create an IAM user with programmatic access, store the access key in AWS Systems Manager Parameter Store, and retrieve it at runtime.


- C) Attach an IAM role (instance profile) to the EC2 instance that grants permission to call bedrock:InvokeModel, allowing the application to use temporary credentials.


- D) Generate a short-term API key daily using an engineer's credentials and manually update the application configuration.


- E) Configure the application to assume an IAM role using hardcoded long-term access keys of a shared IAM user. | Correct Answer: C



Correct Answer Analysis:


- C is Correct: AWS security best practices mandate using IAM roles (like EC2 instance profiles) for production workloads. This provides temporary, automatically rotated security credentials via AWS STS, eliminating the need to manage or distribute long-term secrets while adhering to the principle of least privilege.



Distractor Analysis:


- A is Incorrect: Storing long-term API keys in environment variables on the instance is a security risk, exposing static credentials if the instance is compromised.


- B is Incorrect: While Parameter Store is better than hardcoding, using an IAM user's long-term access keys still requires manual rotation and violates the principle of using temporary credentials for production workloads.


- D is Incorrect: Manual daily generation of short-term API keys introduces immense operational overhead and human error, improperly coupling automated production systems to human user identities.


- E is Incorrect: Hardcoding long-term access keys directly defeats the purpose of IAM roles and temporary credentials, creating a critical security vulnerability.



> Key Takeaway: Production applications running on AWS compute services should always use IAM roles to obtain temporary credentials rather than static IAM users or long-term API keys. | | ### Question 2 - Troubleshooting SageMaker Training Job Access Denied



A machine learning engineer is attempting to launch an Amazon SageMaker training job that reads training data from an Amazon S3 bucket named ml-training-data-2023 and saves model artifacts to ml-artifacts-bucket. The SageMaker execution role currently only has s3:GetObject permissions on arn:aws:s3:::ml-artifacts-bucket/*. The training job fails with an AccessDenied error when trying to read the input data. The company enforces strict least-privilege IAM policies.



Which action should the engineer take to resolve this issue securely? (Select ONE)



- A) Attach the AmazonS3FullAccess managed policy to the SageMaker execution role to ensure the job has access to all buckets.


- B) Update the IAM policy attached to the SageMaker execution role to explicitly grant s3:GetObject on arn:aws:s3:::ml-training-data-2023/*.


- C) Modify the S3 bucket policy of ml-training-data-2023 to allow public read access so the SageMaker job can pull the data.


- D) Add an S3 VPC Gateway Endpoint to the VPC where the SageMaker training job is running.


- E) Grant the SageMaker execution role s3:ListBucket permissions on all S3 buckets in the account. | Correct Answer: B



Correct Answer Analysis:


- B is Correct: The error is an IAM authorization failure because the role lacks read access to the input bucket. The principle of least privilege dictates adding only the specific permission (s3:GetObject) to the exact resource ARN (ml-training-data-2023/*) required for the job.



Distractor Analysis:


- A is Incorrect: Attaching AmazonS3FullAccess violates the least-privilege constraint by granting access to all S3 buckets in the account, introducing a massive security risk.


- C is Incorrect: Making the S3 bucket public is a severe security vulnerability and violates compliance policies for private ML data.


- D is Incorrect: An S3 VPC Gateway Endpoint resolves network routing issues for private subnets, but the error described is an AccessDenied IAM policy issue, not a network connectivity timeout.


- E is Incorrect: s3:ListBucket grants permission to list objects, but the training job needs s3:GetObject to read the actual data. Granting it on all buckets also violates least privilege.



> Key Takeaway: Always read the exact operation and resource in an AccessDenied error and grant only that specific permission to that specific resource, rather than widening the policy broadly. | | ### Question 3 - Securing SageMaker Studio User Profiles



A data science team is setting up an Amazon SageMaker Studio domain for 50 users. The security team mandates that each data scientist must operate under the principle of least privilege, and no user should be able to access another user's SageMaker Studio spaces or shared resources by default. The architecture must minimize operational overhead for identity management.



Which configuration meets these requirements? (Select ONE)



- A) Create a single IAM role with the AmazonSageMakerFullAccess policy and assign this same role to all 50 data scientists' user profiles.


- B) Integrate SageMaker Studio with AWS IAM Identity Center (Successor to AWS SSO) and assign distinct IAM roles scoped to individual user profiles and necessary data resources.


- C) Create 50 separate IAM users with access keys, and require each data scientist to configure their local Studio environment using these keys.


- D) Configure an IAM role with broad permissions, and use AWS Service Control Policies (SCPs) to restrict access per user inside Studio.


- E) Share the root account credentials among the team members to ensure they have full access to manage their own environments. | Correct Answer: B



Correct Answer Analysis:


- B is Correct: Integrating with AWS IAM Identity Center allows the organization to manage human identities centrally and map them to distinct, least-privilege IAM roles for their SageMaker Studio user profiles. This separates human identities from workload identities and scopes permissions appropriately.



Distractor Analysis:


- A is Incorrect: Assigning a shared AmazonSageMakerFullAccess role to all users violates least privilege and makes it difficult to audit individual user actions, as CloudTrail will log all activity under the same role identity.


- C is Incorrect: Creating long-term IAM users with access keys for a managed service like SageMaker Studio is an anti-pattern. Studio handles authentication natively without needing local access keys.


- D is Incorrect: While SCPs restrict account-level actions, they are not designed to isolate individual user sessions within SageMaker Studio. Relying on a broad IAM role still violates least privilege.


- E is Incorrect: Sharing root account credentials is a severe security violation and explicitly prohibited by AWS best practices.



> Key Takeaway: Use AWS IAM Identity Center for human access to SageMaker Studio, mapping users to specific least-privilege roles rather than sharing a single broad role. | | ### Question 4 - Restricting Application Access to a Specific Endpoint



An enterprise has deployed a highly sensitive fraud-detection model on an Amazon SageMaker real-time endpoint. A microservice running on Amazon ECS needs to invoke this endpoint for inference. The security policy dictates that the microservice must be the only application allowed to invoke this specific endpoint, and the permission must be explicitly scoped to that single resource.



How should the ML engineer configure the IAM permissions to meet this requirement? (Select ONE)



- A) Attach an IAM policy to the ECS task role that allows sagemaker:InvokeEndpoint on the specific SageMaker endpoint ARN.


- B) Attach an IAM policy to the ECS task role that allows sagemaker:Invoke* on all SageMaker endpoints in the account.


- C) Configure a resource-based policy on the SageMaker endpoint to allow sagemaker:InvokeEndpoint from the ECS task role's ARN.


- D) Put the SageMaker endpoint and the ECS service in the same VPC and rely on security groups to authenticate the requests.


- E) Create an IAM user for the microservice, generate access keys, and use them to sign the SageMaker API calls. | Correct Answer: A



Correct Answer Analysis:


- A is Correct: The most direct and secure way to grant a specific application permission to a specific resource in AWS is to attach an identity-based policy to the application's role (the ECS task role) that explicitly lists the allowed action (sagemaker:InvokeEndpoint) and restricts the resource to the exact endpoint ARN.



Distractor Analysis:


- B is Incorrect: Using sagemaker:Invoke* on all endpoints violates the constraint of scoping permissions to the single required resource, granting unnecessary access to other models.


- C is Incorrect: While resource-based policies exist for some AWS services, SageMaker endpoints do not support resource-based policies for InvokeEndpoint. Access must be granted via the invoking principal's identity-based policy.


- D is Incorrect: Security groups control network traffic (IP/ports), but they do not perform IAM authentication or authorization. The application still needs IAM permissions to call the API without an AccessDenied error.


- E is Incorrect: Creating an IAM user with static access keys for a microservice violates AWS best practices. ECS tasks should use task roles to obtain temporary credentials.



> Key Takeaway: Scope identity-based IAM policies to the exact ARN of the resource (e.g., a specific SageMaker endpoint) to enforce least privilege for invoking applications. | | ### Question 5 - Cross-Account Model Registry Access



A central data science team in Account A maintains a SageMaker Model Package in a Model Registry. An application running in Account B (a production AWS account) needs to deploy this specific model package to a SageMaker endpoint. The security team requires that Account B's application role can only access this one model package, and no other resources in Account A.



Which combination of steps will grant this access securely? (Select TWO)



- A) In Account A, attach a resource-based policy to the SageMaker Model Package that grants sagemaker:DescribeModelPackage to the IAM role ARN used by the application in Account B.


- B) In Account B, attach an identity-based policy to the application's IAM role that grants sagemaker:DescribeModelPackage on the cross-account ARN of the SageMaker Model Package.


- C) In Account A, attach the AmazonSageMakerFullAccess policy to the application role in Account B using a trust policy.


- D) In Account B, create an IAM user with access keys and share them with Account A to allow cross-account API calls.


- E) In Account A, make the SageMaker Model Package public so that anyone with the ARN can deploy it. | Correct Answers: A and B



Correct Answer Analysis:


- A is Correct: For cross-account access to a specific resource, the owning account (Account A) must attach a resource-based policy to that resource explicitly granting permission to the foreign principal (Account B's role).


- B is Correct: The principal in Account B must also have an identity-based policy allowing it to perform the action on the cross-account resource. Both the resource-based policy and the identity-based policy must allow the action for the request to succeed.



Distractor Analysis:


- C is Incorrect: Granting AmazonSageMakerFullAccess cross-account violates least privilege. Additionally, you cannot attach an AWS managed policy from one account to a role in another account via a trust policy.


- D is Incorrect: Sharing access keys across accounts is a severe security anti-pattern. Cross-account access should be handled via IAM roles and trust policies/resource-based policies, not static credentials.


- E is Incorrect: Making the model package public exposes it to all AWS accounts, massively violating the security requirement to restrict access to only Account B's application.



> Key Takeaway: Cross-account access requires mutual consent: a resource-based policy on the target resource in the owning account, and an identity-based policy on the principal in the trusting account. | | ### Question 6 - Granting Permissions to Launch Training Jobs



A junior data scientist needs to launch Amazon SageMaker training jobs from their local workstation using the SageMaker Python SDK. They have an IAM user with permissions to create training jobs, but the training jobs require an execution role to access S3 data and KMS keys. The data scientist needs permission to pass this specific SageMaker execution role to the training job. The organization enforces least privilege.



Which IAM action must be added to the data scientist's IAM policy to allow them to launch the training job securely? (Select ONE)



- A) iam:PassRole restricted to the specific SageMaker execution role ARN.


- B) iam:AssumeRole restricted to the specific SageMaker execution role ARN.


- C) iam:CreateRole to allow the data scientist to create a new role for each training job.


- D) sagemaker:CreateTrainingJob with Resource: "*", which implicitly passes the role.


- E) iam:AttachRolePolicy to allow the data scientist to modify the execution role's permissions. | Correct Answer: A



Correct Answer Analysis:


- A is Correct: The iam:PassRole permission is explicitly required for a principal to pass an IAM role to an AWS service (like SageMaker). Restricting this action to the specific role ARN ensures the data scientist can only pass the approved execution role, maintaining least privilege.



Distractor Analysis:


- B is Incorrect: iam:AssumeRole is used to switch into a role and obtain temporary credentials for that role, not to pass the role to an AWS service during resource creation.


- C is Incorrect: Allowing the data scientist to create roles does not solve the requirement to pass an existing execution role, and granting iam:CreateRole is overly permissive.


- D is Incorrect: While sagemaker:CreateTrainingJob is required, it does not implicitly grant the right to pass a role. The iam:PassRole action is evaluated separately by IAM.


- E is Incorrect: iam:AttachRolePolicy allows modifying the permissions of the role, which is not needed to launch the job and presents a significant privilege escalation risk.



> Key Takeaway: To pass an IAM role to an AWS service (e.g., a SageMaker execution role), the principal launching the resource needs explicit iam:PassRole permission scoped to that role's ARN. | | ### Question 7 - Restricting Bedrock Model Access via IAM



An enterprise is providing access to Amazon Bedrock to its internal developers. The security team has mandated that a specific group of developers working on a chatbot application should only be allowed to invoke the Anthropic Claude foundation models. They must not be able to invoke any other foundation models or provisioned throughput resources. The solution must minimize operational overhead.



How can the ML engineer configure this access securely? (Select ONE)



- A) Create an IAM policy that allows bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream, setting the Resource to arn:aws:bedrock:*::foundation-model/anthropic.claude*.


- B) Use Amazon Bedrock Guardrails to block all foundation models except Anthropic Claude.


- C) Configure AWS PrivateLink to route requests only to the Anthropic Claude endpoints.


- D) Create separate AWS accounts for developers who need access to Anthropic Claude models.


- E) Attach the AmazonBedrockFullAccess managed policy to the developers' roles, and rely on application-level logic to restrict model selection. | Correct Answer: A



Correct Answer Analysis:


- A is Correct: IAM identity-based policies are the correct mechanism to control access to AWS service APIs. By specifying the bedrock:InvokeModel action and restricting the resource ARN using a wildcard for Anthropic Claude models (arn:aws:bedrock:*::foundation-model/anthropic.claude*), the engineer enforces least privilege with minimal operational overhead.



Distractor Analysis:


- B is Incorrect: Amazon Bedrock Guardrails are used to filter the content of prompts and responses (e.g., blocking harmful content or PII), not to restrict which foundation models a user is authorized to invoke via IAM.


- C is Incorrect: AWS PrivateLink provides private network connectivity to AWS services, but it does not perform IAM authorization or filter which specific models can be invoked.


- D is Incorrect: Creating separate AWS accounts introduces massive operational overhead and does not natively restrict model access without additional IAM configurations anyway.


- E is Incorrect: AmazonBedrockFullAccess allows invocation of all models and violates the strict least-privilege security mandate. Relying on application-level logic is a security anti-pattern (defense in depth requires IAM controls).



> Key Takeaway: Use IAM policies with specific resource ARNs (e.g., arn:aws:bedrock:*::foundation-model/anthropic.claude*) to restrict access to specific foundation models in Amazon Bedrock. | | ### Question 8 - Exploration Credentials for External Contractors



A company has hired an external contractor for a short-term project to build a proof-of-concept application that calls Amazon Bedrock foundation models. The contractor will run the code locally on their own machine. The security team wants to provide a credential that is documented for exploration and development, backed by its own identity, and has a specific expiry set, without modifying the contractor's primary IAM user's long-term access keys.



Which credential approach should the engineer recommend for this exploration phase? (Select ONE)



- A) A short-term API key generated from the contractor's IAM identity that expires at the end of the session.


- B) A long-term API key generated for the foundation model, backed by its own identity with a set expiry.


- C) Hardcoding the contractor's IAM user access key and secret key directly into the Python script.


- D) Creating an IAM role in the production account and having the contractor assume it using a web identity federation flow.


- E) Providing the AWS account root user credentials to the contractor for the duration of the project. | Correct Answer: B



Correct Answer Analysis:


- B is Correct: According to AWS best practices for foundation models, a long-term API key is backed by its own identity with an expiry that is set for it. AWS documents this approach for exploration and development rather than for production. It fits the requirement of a local proof-of-concept with a set expiry without touching the primary IAM user keys.



Distractor Analysis:


- A is Incorrect: A short-term API key expires with the identity's session (e.g., when the console session ends). For a local development script running over several days, a session-based short-term key would require frequent re-authentication, which is less convenient for an extended exploration phase compared to a long-term API key with a custom expiry.


- C is Incorrect: Hardcoding IAM user access keys into a script is a severe security violation and violates AWS best practices.


- D is Incorrect: Web identity federation is used for production applications (e.g., logging in via Google/Cognito to assume a role), not for a local contractor running a script for exploration. It adds unnecessary complexity for a short-term proof-of-concept.


- E is Incorrect: Root user credentials should never be shared under any circumstances.



> Key Takeaway: For local exploration and development outside of a production AWS compute environment, AWS supports using a long-term API key for foundation models, which has its own identity and a specific expiry. | | ### Question 9 - Securing ML CI/CD Pipelines



A DevOps team is building a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild to assemble container images for a SageMaker inference endpoint. The security mandate requires that the pipeline runs with least privilege, can push images to a specific Amazon ECR repository, and cannot modify IAM roles or access other AWS services. The pipeline must fail if an image contains critical vulnerabilities.



Which combination of configurations will satisfy these requirements? (Select TWO)



- A) Create a CodeBuild service role with an IAM policy allowing ecr:PutImage and ecr:BatchGetImage only on the specific ECR repository ARN.


- B) Attach the AdministratorAccess policy to the CodeBuild service role to ensure the pipeline does not encounter AccessDenied errors.


- C) Enable Amazon ECR image scanning on the repository and configure CodeBuild to fail the build if the scan finding severity is CRITICAL or HIGH.


- D) Grant the CodeBuild service role iam:PassRole so it can assume the SageMaker execution role to test the endpoint locally.


- E) Use AWS CloudTrail to monitor the pipeline and automatically halt it if it attempts to call an unauthorized API. | Correct Answers: A and C



Correct Answer Analysis:


- A is Correct: To enforce least privilege, the CodeBuild service role should only have permissions to perform its specific tasks. Restricting ecr:PutImage and ecr:BatchGetImage to the specific repository ARN prevents the pipeline from pushing images to unauthorized repositories or modifying IAM roles.


- C is Correct: Enabling ECR basic or enhanced image scanning (powered by Amazon Inspector) and configuring CodeBuild to fail the build based on finding severity directly addresses the requirement to prevent vulnerable images from being deployed.



Distractor Analysis:


- B is Incorrect: Attaching AdministratorAccess explicitly violates the least-privilege security mandate and would allow the pipeline to modify IAM roles or access other AWS services.


- D is Incorrect: Granting iam:PassRole is unnecessary for building and pushing a container image, and it introduces a privilege escalation risk if the pipeline is compromised.


- E is Incorrect: While CloudTrail records API activity, it is an auditing and monitoring tool, not an active enforcement mechanism to halt pipelines in real-time. IAM policies and ECR scan policies are the correct preventative controls.



> Key Takeaway: Secure CI/CD pipelines by scoping the service role's IAM policy to the specific ECR repository ARN and using ECR image scanning as a build gate to block vulnerable images. | | ### Question 10 - Securely Accessing ML Artifacts from EC2



A machine learning engineer has deployed an inference application on an Amazon EC2 instance. The application needs to download a serialized model artifact from an Amazon S3 bucket and then invoke an Amazon SageMaker endpoint for batch transformation. The security policy requires that no long-term credentials be stored on the instance and that the application uses temporary credentials automatically.



Which AWS feature allows the application to securely access the S3 bucket and SageMaker endpoint without managing credentials? (Select ONE)



- A) AWS Secrets Manager to store an IAM user's access key, which the application queries at runtime.


- B) An IAM instance profile attached to the EC2 instance, granting permissions for s3:GetObject and sagemaker:InvokeEndpoint.


- C) Hardcoding the AWS account root user credentials in the application's configuration file.


- D) Configuring an S3 bucket policy to allow public read access and invoking the SageMaker endpoint without authentication.


- E) Using AWS Systems Manager Session Manager to manually pass temporary tokens to the application. | Correct Answer: B



Correct Answer Analysis:


- B is Correct: An IAM instance profile is a container for an IAM role that you can use to grant temporary, automatically rotated credentials to an EC2 instance. The application running on the instance retrieves these credentials from the instance metadata service to sign AWS API requests, completely avoiding the need to manage long-term keys.



Distractor Analysis:


- A is Incorrect: While AWS Secrets Manager is a valid way to store secrets, the scenario explicitly requires avoiding long-term credentials and using temporary credentials automatically. Instance profiles handle this natively without application code to query Secrets Manager.


- C is Incorrect: Hardcoding root user credentials is a severe security violation and explicitly prohibited by AWS best practices.


- D is Incorrect: Making S3 buckets public and calling SageMaker endpoints without authentication are severe security vulnerabilities that violate the core principles of securing ML workloads.


- E is Incorrect: Session Manager is for secure shell access to instances, not for programmatically passing credentials to a running application.



> Key Takeaway: Use IAM instance profiles for EC2 instances to automatically provide temporary, least-privilege credentials to applications, eliminating the need to manage or hardcode long-term access keys. |