MLS-C01 Question 340
Single answerYou are building a machine learning workflow on AWS and need a SageMaker notebook instance to access data stored in an S3 bucket. According to the principle of least privilege, how should you configure access so the notebook instance can read data from the S3 bucket?
- A
Attach an IAM policy to the IAM role associated with the SageMaker notebook instance, granting read access to the specific S3 bucket.
- B
Enable public access on the S3 bucket so the SageMaker notebook instance can read the data.
- C
Attach an IAM policy to the SageMaker notebook instance itself, specifying read-only access to the S3 bucket.
- D
Grant full administrative access to the SageMaker notebook instance by attaching the 'AdministratorAccess' policy to its IAM role.
Show answer and explanation
Correct answer: A
Explanation
The principle of least privilege dictates that resources should be granted only the permissions they need to perform their tasks. In this case, the correct approach is to attach an IAM policy to the SageMaker notebook instance's role, granting it specific read access to the S3 bucket. This ensures secure and controlled access without over-provisioning permissions.
- A. Correct.
Correct. Attaching an IAM policy to the IAM role associated with the SageMaker notebook instance is the recommended and secure way to grant access to the S3 bucket while adhering to the principle of least privilege.
- B. Incorrect.
Incorrect. Enabling public access on the S3 bucket is insecure and violates best practices, as it exposes the bucket to anyone on the internet.
- C. Incorrect.
Incorrect. IAM policies cannot be directly attached to the notebook instance itself; they must be attached to an IAM role that the notebook instance assumes.
- D. Incorrect.
Incorrect. Granting full administrative access violates the principle of least privilege and unnecessarily exposes the environment to risks.