5.1Standard
An inference service should read one S3 bucket.
A cross-account path is also required.
Choose two designs.
× Incorrect
Specify principals, actions, resource ARNs, conditions, and external accounts, and test trust, resource policies, SCPs, and explicit denies together.
Detailed explanation
CorrectSpecify principal, action, resource ARN, conditions, and external account
The intended scope is explicit.
IncorrectAllow another account without checking trust
An unintended principal may gain access.
CorrectTest trust, resource, SCP, and explicit-deny policy evaluation together
Combined authorization is verified.
IncorrectAllow an entire bucket with a wildcard
Least privilege is lost.
Check official documentation
Compare the following points with the official documentation.
AWS IAM公式とAIF-C01 Domain 5.1のリソースポリシー、SCP、最小権限を確認する。
Official references
What to confirm
AIサービスのリソースアクセスを主体・操作・ARN・条件で限定できる。
Key points
- ARN
- Resource policy
- SCP
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Resource policy
A policy attached to a resource that can grant or restrict access by principal.
Trust policy
The policy on an IAM role that defines which principals may assume it.
Question IDAWS-AIF-364
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue