Q: 2
A company wants to create a chatbot by using a foundation model (FM) on Amazon Bedrock. The FM
needs to access encrypted data that is stored in an Amazon S3 bucket.
The data is encrypted with Amazon S3 managed keys (SSE-S3).
The FM encounters a failure when attempting to access the S3 bucket data.
Which solution will meet these requirements?
Options
Discussion
D , seen similar in practice exams and official docs mention data classification too.
I see why B might look tempting, since public access would let anything read the S3 files. But that's risky in AWS and not how you'd usually solve it. Seems reasonable for fixing a quick access error if security isn't a concern though.
A tbh, that's the only one that addresses IAM permissions for accessing encrypted S3 data. Bedrock needs a role with s3:GetObject access, otherwise it'll keep failing. Pretty sure that's what the question is testing for.
Not B, A fixes the IAM permission trap here. Public access (B) is risky and unrelated with SSE-S3 encrypted data.
B? Public access would let the model reach the bucket no matter what encryption is used.
Likely A, since with SSE-S3, the main thing is ensuring the role Bedrock uses gets s3:GetObject permissions. S3 manages the decryption behind the scenes, but IAM still controls it. Public access (B) isn't secure and prompt engineering (C) doesn't fix perms issues. Pretty sure on this but let me know if you see it different.
Probably A. is correct. Bedrock needs the IAM role permission to decrypt the data, since SSE-S3 handles keys but still checks for proper access. Official AWS docs and practice exams cover this, pretty sure that's what they're after.
I’d say B could work if the chatbot just needs access, since public access bypasses some restrictions. But that's not really best practice in AWS security. Could be missing something though, open to other ideas.
This is a good IAM practice example. A is right since Bedrock needs the correct role permissions for S3 decryption (SSE-S3 handles the keys but still checks permissions). I’ve seen a similar scenario in the official AWS guides and practice exams, so I’m pretty confident.
A
Be respectful. No spam.
