MLA-C01 ML Model Development Practice Question

A machine learning engineer is preparing a training dataset stored in Amazon S3 for a SageMaker training job. The data is in CSV format, and the engineer wants to ensure that the training job can access the data efficiently and securely. The S3 bucket is in the same AWS Region as the SageMaker training job. The engineer needs to provide the training job with the necessary permissions to read the data. Which of the following is the MOST secure and appropriate way to grant the training job access to the S3 bucket?

⚠ Common exam trap

The trap here is assuming that presigned URLs or embedded credentials are acceptable for long-running training jobs, when they introduce security and reliability risks.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an IAM role with a policy that allows s3:GetObject on the specific S3 bucket and attach it to the SageMaker training job.

The correct approach is to create an IAM role with a policy that grants s3:GetObject permission on the specific S3 bucket and attach it to the SageMaker training job. This follows the principle of least privilege and allows the training job to access the data securely without embedding credentials. It is the standard method for granting SageMaker training jobs access to S3 data.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Store AWS credentials (access key and secret key) in the training script and use them to access S3 directly.
Why it's wrong here
Embedding long-term AWS credentials in the training script is a security risk because the script may be stored in source control or logs. It violates AWS security best practices. Instead, IAM roles should be used to provide temporary credentials automatically to the training job.
✓
Create an IAM role with a policy that allows s3:GetObject on the specific S3 bucket and attach it to the SageMaker training job.
Why this is correct
This approach follows the principle of least privilege by granting only the necessary s3:GetObject permission on the specific bucket. The IAM role is assumed by the SageMaker training job, allowing secure access without embedding credentials. It is the recommended practice for SageMaker training jobs to access S3 data.
✗
Make the S3 bucket public and allow the training job to read the data without authentication.
Why it's wrong here
Making the S3 bucket public exposes the data to unauthorized access and violates security best practices. It also may incur unexpected costs and is not suitable for sensitive data. SageMaker training jobs should access data securely using IAM roles, not public buckets.
✗
Generate a presigned URL for each object in the S3 bucket and pass the URLs as hyperparameters to the training job.
Why it's wrong here
Presigned URLs are temporary and can expire, causing training failures if the job runs longer than the URL validity. They also expose the URLs in hyperparameters, which may be logged. This method is not scalable for large datasets and does not follow best practices for secure, long-running training jobs.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

MLA-C01 ML Model Development Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question