An inference role should read only a subset of S3 objects.
Further restrict the access path.
Choose two designs.
Use resource ARNs, prefixes, encryption keys, and network conditions, then review policy inheritance, explicit denies, and organization controls.
Detailed explanation
The role is limited to the intended scope.
The role is limited to the intended scope.
Unexpected inheritance and gaps are checked.
Unexpected inheritance and gaps are checked.
Misconfiguration becomes harder to detect.
Misconfiguration becomes harder to detect.
Least privilege is lost.
Least privilege is lost.
Try it yourself
An example you can run in a temporary verification environment.
AWS IAM公式の条件キー、リソースポリシー、SCPとAIF-C01 Domain 5.1を確認する。Expected result
AIワークロードの権限をARN・条件・拒否・組織ポリシーで限定できる。Key points
- Condition key
- ARN
- Explicit deny
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.