A generative application reads documents from one S3 prefix.
It does not need writes or access to other buckets.
Which IAM design is most appropriate?
Use a dedicated role with only the required read action and resource scope.
Detailed explanation
Limit principal, action, and resource to the stated need.
Limit principal, action, and resource to the stated need.
Excess privilege increases compromise impact.
Excess privilege increases compromise impact.
Long-lived credentials can leak and are difficult to rotate safely.
Long-lived credentials can leak and are difficult to rotate safely.
This exceeds the requirement.
This exceeds the requirement.
Try it yourself
An example you can run in a temporary verification environment.
AWS IAM公式User Guideのロール、ポリシー、最小権限を確認する。Expected result
AIだから特別な管理者権限が必要という誤解を避け、通常のIAM最小権限を説明できる。Key points
- Dedicated role
- Resource scope
- Avoid long-lived keys
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.