MLA-C01 Question 442
Single answerA data scientist is using Amazon SageMaker to train a model and store training data in an Amazon S3 bucket. The organization requires that access to the S3 bucket is tightly controlled and that the SageMaker training job has sufficient permissions to read the training data. What is the most appropriate approach to ensure compliance with these requirements?
- A
Attach a bucket policy to the S3 bucket that grants public read access to the training data.
- B
Use AWS SageMaker Role Manager to create an IAM role with a custom policy that grants SageMaker access to the S3 bucket and attach the role to the training job.
- C
Attach an inline policy to the SageMaker execution role that allows access to all S3 buckets in the account.
- D
Add the SageMaker execution role to an IAM group that has permissions to access the S3 bucket.
Show answer and explanation
Correct answer: B
Explanation
The most secure and efficient way to grant Amazon SageMaker access to the specific S3 bucket is by creating and attaching an IAM role with a custom policy using AWS SageMaker Role Manager. This ensures that the permissions are limited to the required resources, following the principle of least privilege. Other options either expose the bucket unnecessarily or grant overly broad permissions.
- A. Incorrect.
Granting public read access to the S3 bucket is a security risk and violates the principle of least privilege. This does not comply with the organization's requirement for tight access control.
- B. Correct.
Using AWS SageMaker Role Manager to create a custom IAM role ensures that the SageMaker training job has access specifically to the required S3 bucket. This adheres to the principle of least privilege and provides the necessary permissions.
- C. Incorrect.
Attaching an inline policy allowing access to all S3 buckets in the account violates the principle of least privilege and grants excessive permissions beyond what is required.
- D. Incorrect.
Adding the SageMaker execution role to an IAM group with S3 bucket permissions is not the most precise or recommended method. Instead, attaching a specific role with the required permissions is a better practice.