A. Create an Amazon Bedrock custom service role for each team that has access to only the team's customer data.: This would require multiple service roles for Amazon Bedrock itself, which could lead to unnecessary complexity and overhead in role management. It's better to use IAM roles to control team-specific data access.

A. Create an Amazon Bedrock custom service role for each team that has access to only the team's customer data While this restricts data access, managing multiple service roles for Amazon Bedrock per team is unnecessarily complex and does not align with Bedrock’s design of using a single service role. B. Create a custom service role that has Amazon S3 access. Ask teams to specify the customer name on each Amazon Bedrock request Relying on teams to specify the customer name without enforcing access control policies does not guarantee compliance with the security policy. C. Redact personal data in Amazon S3. Update the S3 bucket policy to allow team access to customer data Redacting personal data is helpful for privacy but does not solve the issue of restricting access based on team-specific customer data.

I think it should be D, one IAM role for the service, and multiple IAM roles for the teams

A: Create an Amazon Bedrock custom service role for each team that has access to only the team's customer data. Explanation: To comply with the company's security policy requiring each team to access only their own customer data, the best approach is to create custom service roles in Amazon Bedrock for each team. These roles should have fine-grained permissions, granting access only to the specific Amazon S3 data (e.g., folders or buckets) associated with each team's customers. This ensures compliance with the principle of least privilege. Wrong: D. Create one Amazon Bedrock role that has full Amazon S3 access. Create IAM roles for each team that have access to only each team's customer folders: Giving Bedrock full S3 access is a major security risk. Even with team-specific IAM roles, the Bedrock role could be exploited to access any data in S3.

The trick of this question is Bedrock will use which role to access S3 data. It uses service role. For D, even each customer is restricted to a specific S3 bucket, once the customer uses Bedrock, Bedrock still uses all S3 data to generate the result.

By creating a single Bedrock role with full S3 access and then using IAM roles to control access to the customer data folders, the company can meet its requirements for developing the LLM application while also adhering to its security policy.

Creating a Bedrock role with access to all S3 data violates the principle of least privilege.

Create an Amazon Bedrock custom service role for each team that has access to only the team's customer data. This follows the principle of least privilege — each team gets a dedicated service role that Bedrock assumes, and that role's IAM policy restricts S3 access to only that team's customer data prefix/folder. This ensures data isolation at the service level.

D makes sense on the surface but it talks about distinct customer's folders 📂 , which was not mentioned in the question. And granting Bedrock Full S3 access is certainly a huge red flag. So the answer cannot be D. That leaves "A" as the only plausible solution and answer.

resposta correta é D. Crie uma função do Amazon Bedrock que tenha acesso total ao Amazon S3. Crie funções do IAM para cada equipe que tenha acesso apenas às pastas de clientes de cada equipe. Essa abordagem garante que o modelo de linguagem possa acessar todos os dados armazenados no Amazon S3, enquanto o controle de acesso é gerenciado por funções do IAM. Cada equipe terá acesso exclusivo apenas às pastas de clientes de sua responsabilidade, cumprindo a política de segurança da empresa.

A. Create an Amazon Bedrock custom service role for each team that has access to only the team's customer data.

The correct answer is A. Custom service roles for each team provide granular control over customer data access.

I would say C is incorrect because it doesn't follow least privilege security. The single Bedrock role is a weak point and provides more access than is necessary

Ais the correct answer

Adherence to Principle of Least Privilege: By creating a custom service role for each team that grants access only to their specific customer data in S3, you ensure compliance with the principle of least privilege. Each team will have the minimum necessary permissions to access only their relevant data. D is wrong.

it has to be A. B, absurd C, would let all teams access all data, even if scrubbed/redacted .. D, it would not solve the problem as Bedrock would have access, know and reply with the full knowledge of all customers, IAM roles for each team won't stop Bedrock from knowing and replying with that data.. A. You can also create a custom service role and customize the attached permissions to your specific use-case. If you use the console, you can select this role instead of letting Amazon Bedrock create one for you. https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-sr.html

This option ensures that each team has a dedicated service role with permissions specifically tailored to access only their own customer data. This approach aligns with the company's security policy by enforcing strict access controls at the role level, ensuring that teams cannot access data belonging to other teams. By creating separate roles for each team, the solution adheres to the principle of least privilege, which is a fundamental security best practice. This method also simplifies auditing and management of access permissions, as each role's permissions can be reviewed and adjusted independently.