MLS-C01 Question 337
Single answerA data science team is working on an Amazon SageMaker training job that uses an S3 bucket to store training data. The team wants to ensure that only the SageMaker service has access to this S3 bucket and that no other AWS services or users in the account can access it. Which solution should they implement to meet this requirement?
- A
Attach a policy to the S3 bucket that allows access only from the SageMaker service.
- B
Use an IAM role with an inline policy that allows the SageMaker service to access the S3 bucket and attach the role to the SageMaker instance.
- C
Enable S3 bucket logging and audit access patterns to monitor and restrict access.
- D
Configure an S3 bucket policy with a condition that allows access only when the request originates from a SageMaker-specific VPC endpoint.
Show answer and explanation
Correct answer: D
Explanation
To ensure that only the SageMaker service has access to the S3 bucket, you must use an S3 bucket policy with a condition key that restricts access based on the origin of the requests. Configuring the bucket policy to allow access only from a SageMaker-specific VPC endpoint ensures that only SageMaker can access the data in the bucket. Other options, while useful for granting access or monitoring usage, do not fully restrict access to just the SageMaker service.
- A. Incorrect.
This option is incorrect because attaching a policy to the S3 bucket alone is not sufficient to restrict access to just the SageMaker service. Additional conditions are needed to ensure that no other services or users can access the bucket.
- B. Incorrect.
This option is incorrect because while an IAM role can grant access to SageMaker, it does not restrict other potential access paths to the S3 bucket unless further policies or conditions are applied.
- C. Incorrect.
This option is incorrect because enabling S3 bucket logging provides visibility into access requests but does not restrict or prevent unauthorized access.
- D. Correct.
This option is correct because configuring an S3 bucket policy with a condition that allows access only from a SageMaker-specific VPC endpoint ensures that only SageMaker can access the bucket, effectively blocking access from other services and users.