5.1Basic
A generative application reads documents from one S3 prefix.
It does not need writes or access to other buckets.
Which IAM design is most appropriate?
× Incorrect
Use a dedicated role with only the required read action and resource scope.
Detailed explanation
IncorrectEmbed an access key in source code
Long-lived credentials can leak and are difficult to rotate safely.
CorrectAllow only the required read action on the required prefix
Limit principal, action, and resource to the stated need.
IncorrectAllow read and write to every bucket
This exceeds the requirement.
IncorrectAttach AdministratorAccess
Excess privilege increases compromise impact.
Check official documentation
Compare the following points with the official documentation.
AWS IAM公式User Guideのロール、ポリシー、最小権限を確認する。
Official references
What to confirm
AIだから特別な管理者権限が必要という誤解を避け、通常のIAM最小権限を説明できる。
Key points
- Dedicated role
- Resource scope
- Avoid long-lived keys
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Workload identity
A service can obtain permissions through a role without embedding a permanent secret.
Blast radius
Narrow permissions limit the resources and actions exposed if a workload is compromised.
Question IDAWS-AIF-057
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue