An AI application processes encrypted data.
Give its runtime role only required key operations and trace use.
Choose two appropriate designs.
Limit KMS operations and key resources to the runtime role, monitor use and policy changes, and avoid embedding long-lived key secrets.
Detailed explanation
Encrypted data can be processed with least privilege.
Encrypted data can be processed with least privilege.
Unauthorized use and excessive access can be detected.
Unauthorized use and excessive access can be detected.
A leak can enable broad decryption.
A leak can enable broad decryption.
Key access itself must be protected and audited.
Key access itself must be protected and audited.
Try it yourself
An example you can run in a temporary verification environment.
AWS KMS公式のキーポリシー、IAM、CloudTrailとAIF-C01 Domain 5.1を確認する。Expected result
暗号化だけでなく鍵操作の最小権限と監査を設計できる。Key points
- KMS
- Least privilege
- Audit
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.