MLS-C01 Practice Question: Machine Learning Implementation and Operations

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sagemaker:CreateTrainingJob",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

A data scientist attempts to create a SageMaker training job using the IAM policy shown in the exhibit. The training job fails with an access denied error. What is the most likely cause?

⚠ Common exam trap

A common mix-up: candidates assume only GetObject and PutObject are needed for S3 read/write operations, overlooking that SageMaker's S3 client implicitly calls ListBucket to verify object existence and path resolution before performing data transfers.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The IAM policy is missing the s3:ListBucket action

The IAM policy shown in the exhibit grants s3:GetObject and s3:PutObject actions but is missing the s3:ListBucket action. When SageMaker attempts to read or write objects in an S3 bucket, it first needs to list the bucket's contents to verify the object's existence and path. Without s3:ListBucket, the training job fails with an access denied error during the initial S3 operation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The S3 bucket policy does not grant access to the SageMaker service principal
Why it's wrong here
The error is from the IAM role, not bucket policy.
✗
The IAM policy is missing the sagemaker:DescribeTrainingJob permission
Why it's wrong here
Describe is not needed to create a job.
✓
The IAM policy is missing the s3:ListBucket action
Why this is correct
SageMaker needs ListBucket to read objects from the bucket.
✗
The IAM policy is missing the s3:PutObject permission
Why it's wrong here
PutObject is for writing, not reading training data.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

MLS-C01 Practice Question: Machine Learning Implementation and Operations

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question