A generative-AI application retrieves internal documents from S3.
Allow only the required bucket and read operations.
Which security design is most appropriate?
Use a dedicated IAM role with only the required S3 read permissions and resources.
Detailed explanation
A dedicated execution role limits actions and resources to the stated need.
Excessive privileges enlarge the impact of compromise.
This exceeds the requirement and violates least privilege.
Long-lived credentials in code are a leakage risk.
Check official documentation
Compare the following points with the official documentation.
AWS IAM User Guideのroles、policies、最小権限の公式説明を確認する。
Official references
What to confirm
ロール、リソース、操作を限定し、長期アクセスキーや管理者権限を避ける設計を説明できる。
Key points
- IAM role
- Least privilege
- Avoiding long-lived keys
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Workload identity
An application can obtain permissions through a role without placing a permanent access key in its code.
Permission scope
The role policy should restrict API actions, resources, conditions, and duration to the actual workload.