MLA-C01 Question 432
Single answerYou are building a machine learning model using Amazon SageMaker, and the training dataset is stored in an Amazon S3 bucket. The dataset contains sensitive information, and your security team requires that access to the S3 bucket be restricted to only the SageMaker training job. How can you securely configure access to the dataset?
- A
Attach an IAM role to the SageMaker training job that has permissions to access the S3 bucket and ensure the bucket enforces a bucket policy to allow access only from the SageMaker role.
- B
Make the S3 bucket public and use an IAM policy in SageMaker to ensure only authorized users can access the dataset.
- C
Use AWS Key Management Service (KMS) to encrypt the dataset and allow unrestricted access to the bucket.
- D
Attach an IAM policy directly to the S3 bucket granting access to everyone in your AWS account.
Show answer and explanation
Correct answer: A
Explanation
The best approach to securely access sensitive data in an S3 bucket is to use an IAM role with least privilege attached to the SageMaker training job, combined with an S3 bucket policy that restricts access to only that role. This ensures that only the SageMaker training job can access the data, minimizing the risk of unauthorized access.
- A. Correct.
This is the correct answer because attaching an IAM role to the SageMaker training job and enforcing a bucket policy ensures that only the specific SageMaker role can access the S3 bucket. This approach adheres to the principle of least privilege.
- B. Incorrect.
This is incorrect because making the S3 bucket public exposes sensitive data to the internet, which violates security best practices.
- C. Incorrect.
While encrypting the dataset with AWS KMS is good for data security, allowing unrestricted access to the bucket would still pose a security risk by potentially exposing data to unauthorized users.
- D. Incorrect.
This is incorrect because granting access to everyone in the AWS account does not restrict access to only the SageMaker training job, which does not meet the goal of securing the dataset.