MLS-C01 Question 339
Single answerYou are building a machine learning pipeline using Amazon SageMaker. The pipeline involves training a model on sensitive customer data stored in Amazon S3. To ensure secure access, you create an IAM role for SageMaker to access the S3 bucket. However, during testing, you discover that the SageMaker training job is failing to access the data. Which action is most likely to resolve the issue?
- A
Attach the appropriate AmazonS3ReadOnlyAccess policy to the SageMaker IAM role.
- B
Add a trust relationship to the IAM role allowing SageMaker to assume the role.
- C
Enable multi-factor authentication (MFA) for the IAM role used by SageMaker.
- D
Use an inline policy to explicitly deny access to any other S3 bucket.
Show answer and explanation
Correct answer: B
Explanation
When using an IAM role with Amazon SageMaker, it is essential to configure the role's trust relationship to allow SageMaker to assume the role. Without this configuration, SageMaker cannot use the permissions associated with the role, even if the role has the necessary policies attached. This is a common cause of access issues when working with SageMaker and IAM.
- A. Incorrect.
Attaching the AmazonS3ReadOnlyAccess policy allows access to S3 buckets but does not solve the problem if the role cannot be assumed by SageMaker.
- B. Correct.
Adding a trust relationship to the IAM role allowing SageMaker to assume the role ensures that SageMaker can use the permissions associated with the role to access the S3 bucket.
- C. Incorrect.
Enabling MFA for the IAM role serves as an additional security measure but is not related to resolving access issues in this scenario.
- D. Incorrect.
Using an inline policy to deny access to other S3 buckets is a good security practice but does not address the issue of SageMaker failing to access the intended bucket.