A summarization app needs read access to one S3 bucket and permission to invoke a model.
Separate data access from broader administration.
Choose two appropriate IAM practices.
Grant only required actions and resources, separate roles by service and environment, and never use generated output as the authorization decision.
Detailed explanation
Unneeded deletion, administration, and other buckets remain unavailable.
Unneeded deletion, administration, and other buckets remain unavailable.
This limits scope and reduces blast radius.
This limits scope and reduces blast radius.
Compromise would have excessive impact.
Compromise would have excessive impact.
Authorization must be enforced by trusted server-side controls.
Authorization must be enforced by trusted server-side controls.
Try it yourself
An example you can run in a temporary verification environment.
AWS公式IAM最小権限とAIF-C01 Domain 5.1のAIシステム保護を確認する。Expected result
AIアプリの実行ロールを最小権限で設計し、認可をモデルから分離できる。Key points
- Least privilege
- Role separation
- Authorization
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.