MLS-C01 Question 343
Single answerYou are designing a machine learning pipeline that processes sensitive customer data stored in an Amazon S3 bucket. The data should only be accessible by a specific Amazon SageMaker notebook instance in your AWS account. How should you configure the S3 bucket policy to ensure secure access?
- A
Add a bucket policy that allows access from the SageMaker notebook's IAM role and restricts access to the bucket from all other sources.
- B
Enable public access to the S3 bucket and rely on SageMaker's IAM role to control access.
- C
Use an S3 bucket ACL to allow the SageMaker notebook instance access to the bucket.
- D
Add a bucket policy that allows access from all SageMaker notebook instances in the AWS account.
Show answer and explanation
Correct answer: A
Explanation
The best practice for securing sensitive data in an S3 bucket is to use a bucket policy that explicitly grants access to only the required resources, such as an IAM role associated with a specific SageMaker notebook instance. This ensures fine-grained access control and adheres to the principle of least privilege. Other options either fail to provide adequate security or excessively broaden access.
- A. Correct.
This is the correct approach. By specifying the SageMaker notebook's IAM role in the S3 bucket policy, you can ensure that only the designated notebook instance has access to the bucket. This provides fine-grained control over access.
- B. Incorrect.
This is insecure and does not meet the requirement to protect sensitive customer data. Public access to the S3 bucket could expose the data to unauthorized users.
- C. Incorrect.
S3 bucket ACLs provide limited access control and are not recommended for this use case. Bucket policies offer more flexibility and precision for managing access.
- D. Incorrect.
Allowing access from all SageMaker notebook instances in the AWS account overly broadens access and does not limit it to the specific SageMaker notebook instance, violating the principle of least privilege.