A healthcare startup has deployed a machine learning model on Amazon SageMaker that predicts patient readmission risks. The model uses sensitive health data stored in an S3 bucket encrypted with AWS KMS. The SageMaker endpoint is configured with an IAM role that has the following policy attached: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::healthcare-data/*", "Condition": { "Bool": { "aws:SecureTransport": "true" } } }, { "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "*" } ] }. During a security audit, the team discovers that the IAM role's KMS permission is too permissive because it allows decryption of any KMS key in the account. The team needs to modify the policy to follow the principle of least privilege while still allowing the SageMaker endpoint to read the encrypted data. Which modification should the team make?

Question

A healthcare startup has deployed a machine learning model on Amazon SageMaker that predicts patient readmission risks. The model uses sensitive health data stored in an S3 bucket encrypted with AWS KMS. The SageMaker endpoint is configured with an IAM role that has the following policy attached: {    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": "s3:*",            "Resource": "arn:aws:s3:::healthcare-data/*",            "Condition": {                "Bool": {                    "aws:SecureTransport": "true"                }            }        },        {            "Effect": "Allow",            "Action": "kms:Decrypt",            "Resource": "*"        }    ] }. During a security audit, the team discovers that the IAM role's KMS permission is too permissive because it allows decryption of any KMS key in the account. The team needs to modify the policy to follow the principle of least privilege while still allowing the SageMaker endpoint to read the encrypted data. Which modification should the team make?

Accepted Answer

Change the KMS statement to: "Action": "kms:Decrypt", "Resource": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab". The KMS statement currently allows kms:Decrypt on Resource '*' , which permits decryption with any KMS key in the account. Restricting the Resource to the specific KMS key ARN used to encrypt the S3 bucket enforces least privilege while still allowing the SageMaker endpoint to decrypt the data. This is the correct modification to scope the permission to only the necessary key.

Answer

Change the KMS statement Action to "kms:DescribeKey" instead of "kms:Decrypt"

Answer

Add a condition to the KMS statement: "Condition": { "StringEquals": { "kms:ViaService": "s3.us-east-1.amazonaws.com" } }

Answer

Remove the KMS statement entirely, as S3 bucket policies with SSE-KMS do not require KMS permissions

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

MLA-C01 Practice Question: A healthcare startup has deployed a machine…

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question