PRODUCTION SCENARIO
A SageMaker training job reads one Amazon S3 prefix of training data and writes model artifacts to a second prefix in the same bucket. A security review requires the job's execution role to grant no more access than the job actually uses.
Which approach meets the requirement?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: An inline policy granting s3:GetObject and s3:PutObject on the two prefixes
Granting the two actions the job performs on the two prefixes it touches is the only option that stops at what the job uses. AmazonSageMakerFullAccess reaches every bucket whose name contains sagemaker. An s3:* inline policy still permits delete and bucket-configuration calls across both prefixes, and a permissions boundary caps the ceiling without narrowing what the role is actually granted.