MLS-C01 Question 338
Single answerYou are a Machine Learning Engineer working on an AWS SageMaker project. The team wants to ensure that only specific IAM users can access the SageMaker notebooks and perform operations such as training models, while preventing general access to other AWS services. How can you achieve this securely using AWS Identity and Access Management (IAM)?
- A
Attach an IAM policy to the SageMaker notebook instance granting the required permissions to specific IAM users.
- B
Create an IAM role with the required permissions for SageMaker and attach it to the SageMaker notebook instance.
- C
Create a custom IAM policy that grants SageMaker permissions and attach it directly to the IAM users.
- D
Use an inline policy in the IAM user profiles to grant access to SageMaker while restricting access to other AWS services.
Show answer and explanation
Correct answer: B
Explanation
The best practice for providing secure and restricted access to AWS services, including SageMaker, is to use IAM roles. Attaching a role with the required permissions to the SageMaker notebook instance ensures that the instance can access only the necessary resources without exposing other services to the users. This approach is more secure and aligns with AWS's least privilege and resource-specific permission principles.
- A. Incorrect.
IAM policies cannot be directly attached to SageMaker notebook instances. Permissions must be assigned to users or roles separately.
- B. Correct.
Attaching an IAM role with the required permissions to the SageMaker notebook instance is the correct approach. This allows the notebook to access AWS services securely while restricting access to only the needed permissions.
- C. Incorrect.
While creating a custom IAM policy and attaching it to users can work, this approach is less secure and does not leverage IAM roles, which are a best practice for resource-specific permissions.
- D. Incorrect.
Using inline policies can work, but it is not scalable and does not provide the security benefits of assigning roles to resources like SageMaker instances.