MLA-C01 Question 441
Select 3You are developing a machine learning model on Amazon SageMaker for a financial institution. The model requires access to data stored in an Amazon S3 bucket, and you need to ensure the SageMaker training job can retrieve the data securely. Which steps should you take to configure access correctly?
- A
Attach an IAM policy to the SageMaker service role granting it permissions to access the S3 bucket.
- B
Enable public access on the S3 bucket to allow SageMaker to read the data.
- C
Use the SageMaker Role Manager to create a service execution role, and specify the S3 bucket permissions within the role.
- D
Manually add the SageMaker service role to an IAM group with access to the S3 bucket.
- E
Add a bucket policy to the S3 bucket granting access to the SageMaker service role by its Amazon Resource Name (ARN).
Show answer and explanation
Correct answers: A, C, E
Explanation
To securely allow SageMaker to access an S3 bucket, you should configure permissions either by attaching an IAM policy to the SageMaker service role, using SageMaker Role Manager to create the role with the required permissions, or applying a bucket policy that grants access to the service role by its ARN. These methods align with AWS best practices for managing permissions and maintaining the principle of least privilege. Enabling public access to the bucket or using IAM groups for service roles are not secure or proper solutions.
- A. Correct.
Correct: Attaching an IAM policy to the SageMaker service role that permits access to the S3 bucket is a secure and common way to grant SageMaker the required permissions.
- B. Incorrect.
Incorrect: Enabling public access on the S3 bucket is not secure and violates best practices for handling sensitive data.
- C. Correct.
Correct: The SageMaker Role Manager simplifies the creation of service execution roles, allowing you to specify the required S3 bucket permissions directly.
- D. Incorrect.
Incorrect: Manually adding the SageMaker service role to an IAM group is not a recommended approach. Service roles are designed to be used directly and not through IAM groups.
- E. Correct.
Correct: Adding a bucket policy that explicitly grants access to the SageMaker service role by its ARN is another valid and secure method to provide the necessary permissions.