MLA-C01 Question 397
Single answerA data science team is training a machine learning model using Amazon SageMaker. The training data is located in an Amazon S3 bucket, and the team wants to ensure the following requirements are met:
- The SageMaker training job should have access to the data without exposing it to the public internet.
- The solution should follow AWS security best practices by minimizing permissions.
What is the most appropriate way to configure access to the training data?
- A
Attach an S3 bucket policy that allows public access to the training data.
- B
Create an IAM role with S3 Read permissions, attach the role to the SageMaker training job, and ensure the S3 bucket has a bucket policy allowing access from that role.
- C
Use an IAM user with programmatic access keys to allow the SageMaker training job to access the S3 bucket.
- D
Create a VPC endpoint for Amazon S3, and use an IAM role with S3 Read permissions attached to the SageMaker training job to access the data.
Show answer and explanation
Correct answer: D
Explanation
To meet the requirements, the traffic between SageMaker and S3 should avoid the public internet, and permissions should follow the principle of least privilege. Using a VPC endpoint for Amazon S3 ensures that all communication remains within the AWS network, and attaching an IAM role with appropriate permissions to the SageMaker training job ensures secure and least-privilege access to the S3 bucket.
- A. Incorrect.
This is insecure and violates AWS security best practices as it exposes the data to the public internet.
- B. Incorrect.
While this configuration is functional, it does not fully meet the requirement to avoid public internet exposure as the S3 bucket policy is still used instead of a VPC endpoint.
- C. Incorrect.
IAM users with access keys are not recommended for machine learning workflows as they can lead to credential management challenges and security risks.
- D. Correct.
This is the most secure and appropriate solution. A VPC endpoint for Amazon S3 ensures that traffic between SageMaker and S3 does not traverse the public internet. The IAM role with S3 Read permissions ensures the principle of least privilege is followed.