Use confidential internal documents to customize a model.
Only the required process should access the data, and incorrect data uploads should be limited.
Choose two appropriate controls.
Use a dedicated least-privilege role and encryption for data at rest and in transit; broad administrator access and public buckets are inappropriate.
Detailed explanation
Restrict the execution principal, actions, and resources instead of distributing long-lived credentials.
Public access would expose confidential data and is not needed for evaluation.
Broad permissions increase the impact of errors or compromise.
Encryption reduces exposure while data is stored or transferred.
Check official documentation
Compare the following points with the official documentation.
AWS IAM、Amazon S3暗号化、Amazon Bedrockカスタマイズ公式ドキュメントを確認する。
Official references
What to confirm
実行主体の限定とデータ保護を別の対策として説明できる。
Key points
- Least privilege
- Encryption
- Customization data
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Service trust
A role trust policy controls which AWS service or principal may assume the execution role.
Data lifecycle
Training and customization artifacts need ownership, retention, deletion, and audit decisions as well as encryption.