Use confidential internal documents to customize a model.
Only the required process should access the data, and incorrect data uploads should be limited.
Choose two appropriate controls.
Use a dedicated least-privilege role and encryption for data at rest and in transit; broad administrator access and public buckets are inappropriate.
Detailed explanation
Restrict the execution principal, actions, and resources instead of distributing long-lived credentials.
Restrict the execution principal, actions, and resources instead of distributing long-lived credentials.
Encryption reduces exposure while data is stored or transferred.
Encryption reduces exposure while data is stored or transferred.
Broad permissions increase the impact of errors or compromise.
Broad permissions increase the impact of errors or compromise.
Public access would expose confidential data and is not needed for evaluation.
Public access would expose confidential data and is not needed for evaluation.
Try it yourself
An example you can run in a temporary verification environment.
AWS IAM、Amazon S3暗号化、Amazon Bedrockカスタマイズ公式ドキュメントを確認する。Expected result
実行主体の限定とデータ保護を別の対策として説明できる。Key points
- Least privilege
- Encryption
- Customization data
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.