MLA-C01 Question 438
Select 2You are a machine learning engineer working for a company that stores sensitive training data in an Amazon S3 bucket. You need to configure an Amazon SageMaker notebook instance to access this S3 bucket securely. Which of the following steps will ensure secure and least-privilege access to the bucket?
- A
Create an IAM role with a policy granting read-only access to the S3 bucket and attach it to the SageMaker notebook instance.
- B
Attach the AmazonS3FullAccess managed policy directly to the SageMaker notebook instance's role.
- C
Use the SageMaker Role Manager to generate a role with permissions only for SageMaker and the S3 bucket, and attach it to the notebook instance.
- D
Add a bucket policy to the S3 bucket that allows all SageMaker notebook instances in the account to access it.
- E
Manually assign the SageMaker notebook instance an IAM group with permissions to access the S3 bucket.
Show answer and explanation
Correct answers: A, C
Explanation
Ensuring secure and least-privilege access to an S3 bucket from a SageMaker notebook instance requires creating a specific IAM role with the required permissions or using the SageMaker Role Manager to automate the process. Avoid overly permissive policies such as AmazonS3FullAccess or bucket policies that allow broad access. IAM groups are not used in this context as they cannot be directly assigned to resources like SageMaker notebook instances.
- A. Correct.
This is correct because creating an IAM role with a policy that grants read-only access ensures least-privilege access and secures the connection between the SageMaker notebook instance and the S3 bucket.
- B. Incorrect.
This is incorrect because the AmazonS3FullAccess managed policy grants more permissions than needed, violating the principle of least privilege.
- C. Correct.
This is correct because the SageMaker Role Manager can automate the creation of a role with the required permissions, ensuring secure and targeted access to the S3 bucket.
- D. Incorrect.
This is incorrect because allowing all SageMaker notebook instances in the account to access the S3 bucket is overly permissive and does not follow best practices for least privilege.
- E. Incorrect.
This is incorrect because IAM groups are not directly assignable to SageMaker notebook instances and are not the recommended method for granting access to S3 buckets.