MLA-C01 Question 440
Select 3A data science team is tasked with training and deploying a machine learning model using Amazon SageMaker. To adhere to security best practices, the team needs to ensure minimal permissions are granted while allowing the SageMaker training jobs to access an S3 bucket containing the training data. Which of the following steps should be taken to meet these requirements?
- A
Create an IAM role for SageMaker with an inline policy that grants access to the specific S3 bucket.
- B
Attach the AmazonS3FullAccess policy directly to the SageMaker role to simplify permissions management.
- C
Use SageMaker Role Manager to create a custom role with only the required permissions for SageMaker training jobs and attach it to the SageMaker notebook instance.
- D
Specify the S3 bucket ARN in the bucket policy and allow access to the SageMaker IAM role.
- E
Create an IAM group for the data science team and attach a policy that provides full access to all SageMaker and S3 resources.
Show answer and explanation
Correct answers: A, C, D
Explanation
To securely grant SageMaker access to an S3 bucket for training data, you should follow security best practices by applying the least privilege principle. This involves creating an IAM role for SageMaker with a policy granting access only to the specific S3 bucket, using SageMaker Role Manager to simplify role creation, and ensuring the S3 bucket policy explicitly allows access to the IAM role. Granting overly broad permissions, such as full access to all S3 and SageMaker resources, is not recommended in a production environment.
- A. Correct.
Correct. Creating an IAM role with an inline policy that grants access to the specific S3 bucket ensures that only the necessary permissions are granted, adhering to least privilege principles.
- B. Incorrect.
Incorrect. Attaching AmazonS3FullAccess grants overly broad permissions and violates the principle of least privilege. This is not recommended for production environments.
- C. Correct.
Correct. SageMaker Role Manager helps generate a minimal permissions role for SageMaker training jobs, which is a security best practice.
- D. Correct.
Correct. Defining the S3 bucket ARN in the bucket policy and explicitly allowing access to the SageMaker IAM role ensures that only the specific role can access the bucket.
- E. Incorrect.
Incorrect. Adding the data science team to an IAM group with full access to all SageMaker and S3 resources is unnecessary and violates the principle of least privilege.