AWS Certified Machine Learning Engineer Associate · Free Practice Question Medium
Question 34
A company’s data science team uses Amazon SageMaker notebook instances to develop machine learning models. The team frequently collaborates on projects that require access to shared datasets and specific Amazon S3 buckets. Currently, permissions for accessing S3 buckets are managed by creating individual IAM roles for each SageMaker notebook instance. This decentralized approach has led to inconsistent permissions, duplication of effort, and difficulty in managing access across team members. The company wants to centralize permissions management to ensure all SageMaker notebook instances used by the team can access the required S3 buckets consistently and efficiently.
Which solution will meet this requirement?
-
A
Use inline policies directly on each notebook instance to define local permissions for the data scientists
-
B
Attach a single IAM role with S3 permissions to all SageMaker notebook instances used by the data science team
-
C
Attach the necessary permissions directly to each data scientist's IAM user to enable granular control over access to the notebook instances
-
D
Create an IAM group for the data science team, associate the required S3 access policies to the group, and attach the IAM group directly to the SageMaker notebook instances to grant permissions to all data scientists
Reveal correct answer
Correct answer: B
Explanation
Correct option:
Attach a single IAM role with S3 permissions to all SageMaker notebook instances used by the data science team
The correct way to centralize access to Amazon S3 buckets for SageMaker notebook instances is to:
Create a single IAM role with the required S3 access permissions.
Attach this role to all SageMaker notebook instances used by the data science team.
IAM roles are specifically designed to grant AWS service resources (like SageMaker notebook instances) secure, temporary access to other AWS services. This ensures:
Consistent permissions across all team members.
Simplified management of access policies without duplicating roles.
Scalability as new SageMaker notebook instances are created.
Incorrect options:
Create an IAM group for the data science team, associate the required S3 access policies to the group, and attach the IAM group directly to the SageMaker notebook instances to grant permissions to all data scientists - IAM groups cannot be directly attached to Amazon SageMaker notebook instances or any AWS resources. IAM groups are used to organize IAM users and simplify permission management by attaching policies to the group, which are then inherited by its members. To grant permissions to resources like SageMaker notebook instances, you must use IAM roles or directly attach policies to individual IAM users. This option incorrectly implies that an IAM group can be attached to a notebook instance, which is not supported in AWS.
Attach the necessary permissions directly to each data scientist's IAM user to enable granular control over access to the notebook instances - Assigning policies directly to IAM users creates decentralized management, which becomes difficult to maintain as the team grows.
Use inline policies directly on each notebook instance to define local permissions for the data scientists - This option acts as a distractor. An inline policy is a policy created for a single IAM identity (a user, user group, or role). It cannot be directly attached to a resource, such as the SageMaker notebook instance.
Reference:
https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-roles.html
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
