A summarization app needs read access to one S3 bucket and permission to invoke a model.
Separate data access from broader administration.
Choose two appropriate IAM practices.
Grant only required actions and resources, separate roles by service and environment, and never use generated output as the authorization decision.
Detailed explanation
Authorization must be enforced by trusted server-side controls.
Unneeded deletion, administration, and other buckets remain unavailable.
This limits scope and reduces blast radius.
Compromise would have excessive impact.
Check official documentation
Compare the following points with the official documentation.
AWS公式IAM最小権限とAIF-C01 Domain 5.1のAIシステム保護を確認する。
Official references
What to confirm
AIアプリの実行ロールを最小権限で設計し、認可をモデルから分離できる。
Key points
- Least privilege
- Role separation
- Authorization
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Least privilege
Allowing only the operations, resources, and conditions required for a task.
Execution role
An IAM role assumed by a service or workload to obtain temporary permissions.