MLA-C01 Question 439
Single answerA data scientist is using Amazon SageMaker to train a machine learning model. The model training script needs access to data stored in an Amazon S3 bucket and logs should be written to Amazon CloudWatch. The data scientist does not want to provide long-term AWS credentials in the training script. What is the best way to configure access to ensure the least privilege principle is followed?
- A
Attach an IAM role with permissions to access S3 and CloudWatch to the SageMaker notebook instance.
- B
Create an S3 bucket policy allowing access to all SageMaker services for the S3 bucket.
- C
Attach an IAM role with permissions to access S3 and CloudWatch to the SageMaker training job.
- D
Manually provide AWS access keys in the training script to access S3 and CloudWatch.
Show answer and explanation
Correct answer: C
Explanation
The least privilege principle requires that access is granted only to the resources and actions needed for the task. Attaching an IAM role with the necessary permissions directly to the SageMaker training job ensures that only the training job has access to Amazon S3 and CloudWatch, without affecting other resources like SageMaker notebook instances or hardcoding credentials in the script. This is the most secure and scalable solution.
- A. Incorrect.
This option would grant permissions to the SageMaker notebook instance, but it wouldn't apply to the training job itself. Also, this might inadvertently grant permissions to other processes running on the notebook instance, violating the least privilege principle.
- B. Incorrect.
This grants overly broad access to all SageMaker services, which violates the least privilege principle. A bucket policy should be scoped down to specific roles or resources.
- C. Correct.
Attaching an IAM role with the required permissions directly to the SageMaker training job ensures that only the training job has the necessary permissions, following the least privilege principle. This is the best approach.
- D. Incorrect.
Providing AWS access keys in the training script is insecure and not recommended. Credentials should not be hardcoded in scripts, as this increases the risk of compromise.