5.1Standard
An inference role should read only a subset of S3 objects.
Further restrict the access path.
Choose two designs.
× Incorrect
Use resource ARNs, prefixes, encryption keys, and network conditions, then review policy inheritance, explicit denies, and organization controls.
Detailed explanation
CorrectUse resource ARNs, prefixes, encryption keys, and endpoint conditions to narrow access
The role is limited to the intended scope.
IncorrectAllow every resource with a wildcard
Least privilege is lost.
IncorrectComplex conditions remove the need for testing or documentation
Misconfiguration becomes harder to detect.
CorrectReview and audit policy changes and test explicit denies and organization policies
Unexpected inheritance and gaps are checked.
Check official documentation
Compare the following points with the official documentation.
AWS IAM公式の条件キー、リソースポリシー、SCPとAIF-C01 Domain 5.1を確認する。
Official references
What to confirm
AIワークロードの権限をARN・条件・拒否・組織ポリシーで限定できる。
Key points
- Condition key
- ARN
- Explicit deny
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
IAM condition key
A policy element that limits access using context such as resource, tag, network, or time.
Explicit deny
A policy decision that overrides an allow for the specified action and resource.
Question IDAWS-AIF-308
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue