A generative-AI application retrieves internal documents from S3.
Allow only the required bucket and read operations.
Which security design is most appropriate?
Use a dedicated IAM role with only the required S3 read permissions and resources.
Detailed explanation
A dedicated execution role limits actions and resources to the stated need.
A dedicated execution role limits actions and resources to the stated need.
Excessive privileges enlarge the impact of compromise.
Excessive privileges enlarge the impact of compromise.
Long-lived credentials in code are a leakage risk.
Long-lived credentials in code are a leakage risk.
This exceeds the requirement and violates least privilege.
This exceeds the requirement and violates least privilege.
Try it yourself
An example you can run in a temporary verification environment.
AWS IAM User Guideのroles、policies、最小権限の公式説明を確認する。Expected result
ロール、リソース、操作を限定し、長期アクセスキーや管理者権限を避ける設計を説明できる。Key points
- IAM role
- Least privilege
- Avoiding long-lived keys
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.