A batch job accesses S3 and an inference service.
Avoid long-lived keys and restrict permissions.
Choose two designs.
Assign an IAM role with only required actions and resources, separate roles by purpose, and audit use and review permissions.
Detailed explanation
Short-lived credentials and least privilege are used.
Short-lived credentials and least privilege are used.
Blast radius and use can be tracked.
Blast radius and use can be tracked.
Secrets can leak through code or logs.
Secrets can leak through code or logs.
One compromise enables broad access.
One compromise enables broad access.
Try it yourself
An example you can run in a temporary verification environment.
AWS IAM公式のロール、最小権限、CloudTrailとAIF-C01 Domain 5.1を確認する。Expected result
AIワークロードの認証情報をロールと最小権限で管理できる。Key points
- IAM role
- Short-lived credentials
- Least privilege
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.