Skill 4.3.2: Configure least privilege access to ML and AI artifacts

Task 4.3: Operating, Monitoring, and Securing ML and AI Solutions — Secure ML and AI workloads and model endpoints

Core objective: Grant every human, workload, and pipeline only the actions required on the exact ML/AI artifact—nothing broader. Protects training data, model weights, embeddings, prompts, endpoints, and IP; enables audit/compliance and reduces exfiltration, poisoning, and unauthorized invocation risk.

Least-privilege formula: principal + action + resource + condition. Scope by ARN, S3 prefix, tag, VPC endpoint, KMS key, and source account.

Artifact → Least-Privilege Control Map

Artifact / Service	Grant only	Scope tightly with	Common trap
Training data / S3	s3:GetObject, s3:PutObject, s3:ListBucket	Bucket/prefix ARN, s3:prefix, tags, KMS key, VPC endpoint	s3:* on *
Model artifacts / S3	s3:GetObject, s3:PutObject	Model bucket/prefix, versioning, KMS	Public bucket; shared prefix across teams
Feature Store	sagemaker:GetRecord, PutRecord, DescribeFeatureGroup	Feature group ARN, offline S3 prefix	Broad feature group access
Model Registry	sagemaker:CreateModelPackage, UpdateModelPackage, DescribeModelPackage	Model package group ARN	Bypass approval workflow
Endpoints	sagemaker:InvokeEndpoint, CreateEndpoint, UpdateEndpoint	Endpoint ARN, tags, VPC endpoint	InvokeEndpoint on *
Container images / ECR	ecr:BatchGetImage, GetDownloadUrlForLayer	Repository ARN, image tags, KMS	ecr:*; public repo
Bedrock FMs	bedrock:InvokeModel, Converse, InvokeModelWithResponseStream	Model ARN, guardrail ARN, VPC endpoint	Invoke all models; no guardrail
Knowledge Bases / Agents	bedrock:Retrieve, RetrieveAndGenerate, InvokeAgent	KB/agent ARN	Broad bedrock:*
Secrets	secretsmanager:GetSecretValue	Secret ARN, kms:ViaService	Secret in code/image/env
KMS keys	kms:Decrypt, GenerateDataKey	Key ARN, ViaService, encryption context	Key policy missing role

IAM Building Blocks & Boundaries

• Identity policies grant to users/roles; resource policies grant on S3, ECR, KMS, and some Bedrock resources; both may be required cross-account.
• Permission boundaries cap max permissions for delegated admins; SCPs cap entire AWS Organizations accounts.
• Workload roles: SageMaker execution role, pipeline role, Lambda role, Bedrock agent role. Keep human identity separate from workload identity.
• PassRole: To let SageMaker/Bedrock use a role, principal needs iam:PassRole on that role; service trust policy must allow the service. Restrict with iam:PassedToService.
• ABAC/tags: Use aws:ResourceTag, aws:RequestTag, aws:PrincipalTag for scalable least privilege.
• Network conditions: aws:SourceVpc, aws:SourceVpce, aws:SourceAccount, aws:PrincipalArn, kms:ViaService.
• SageMaker Role Manager: Predefined personas generate least-privilege roles for data scientists, MLOps, and pipelines.
• IAM Access Analyzer: Policy generation from CloudTrail activity and findings for public/cross-account access.

When to Use X vs Y

Decision	Use	Avoid
Production model access	IAM role + temporary STS credentials	Long-term Bedrock API keys
Exploration/dev FM access	Short-term Bedrock API key (inherits generator permissions, expires)	Hardcoded keys
Static secret	Secrets Manager with rotation	Env var, code, image
Cross-account artifact	Resource policy + identity policy + KMS key policy	Broad bucket ACL
Pipeline access	Dedicated pipeline execution role per stage	Reusing admin/human role
Network restriction	VPC endpoint + endpoint policy + security groups	Opening internet route
Permission cap	Permission boundary or SCP	Widening IAM policy to fix AccessDenied

Security, Audit & Compliance

• Encryption: KMS customer managed keys for S3/ECR/SageMaker/Bedrock artifacts. Key policy must allow the principal; IAM alone is insufficient.
• Network: VPC endpoints (PrivateLink) for S3, ECR, SageMaker, Bedrock, KMS, Secrets Manager. Endpoint policies restrict which actions/resources can pass.
• Audit: CloudTrail management events default; data events for S3 object access and model invocation (InvokeEndpoint, InvokeModel) must be enabled. Config detects drift. IAM Access Analyzer finds public/cross-account access. Access Advisor finds unused permissions.
• Pipeline scanning: CodeGuru Security for code/hardcoded credentials; Inspector for ECR image CVEs and unintended network exposure.
• Runtime safeguards: Bedrock Guardrails filter content, PII, denied topics, grounding, automated reasoning. Separate from IAM access control.

Exam Gotchas

KMS key policy is mandatory for decryption. IAM policy alone cannot decrypt a KMS-encrypted artifact if the key policy does not allow the principal. Cross-account KMS requires key policy + IAM. CloudTrail data events are off by default. Model invocation and S3 object reads may not appear unless data events are configured. Bedrock API keys: Short-term inherits generating identity; long-term is for dev/exploration. Production = IAM role temporary credentials. PassRole ≠ service use. Need iam:PassRole + service trust policy + resource permissions. Least privilege is layered. IAM, resource policies, KMS, VPC endpoint policies, Secrets Manager rotation, and Guardrails are separate controls. S3 cross-account: Both identity policy and bucket policy must allow. ACLs are not recommended. Do not widen a policy to clear AccessDenied. Read the denied action and resource; grant only that action on that resource.

Anti-Patterns

• Wildcard Action: * or Resource: * on ML roles.
• One admin execution role for notebooks, training, endpoints, pipelines.
• Storing Bedrock/API keys in code, images, notebooks, env vars.
• Public S3 model/data buckets or public ECR repos.
• Over-broad bedrock:InvokeModel on all models.
• Ignoring KMS key policies and VPC endpoint policies.
• No separation between human and workload identities.
• No data-event logging for model invocations or artifact access.

Quick Recall

• Least privilege: principal + action + resource + condition. Scope to ARN, prefix, tag, VPC endpoint, KMS key.
• Production credential: IAM role temporary credentials. Exploration: Bedrock API keys.
• Artifact protection: S3 + KMS + bucket policy; ECR + repo policy; SageMaker + execution role; Bedrock + IAM + Guardrails.
• Audit trio: CloudTrail (who), Config (configuration), data events (what data/model).
• Network isolation: VPC + subnet + SG + VPC endpoint; endpoint policy restricts service access.