Question

A healthcare company stores sensitive patient records in an Amazon S3 bucket that will be used as a training dataset for a SageMaker model. The security team requires that only a specific SageMaker execution role can read the training data, and all access attempts must be logged for compliance audits. Which combination of controls BEST meets these requirements?

Accepted Answer

Attach an S3 bucket policy that grants read access only to the SageMaker execution role's ARN, and enable AWS CloudTrail data events for the bucket.

Answer

Make the S3 bucket public but enable S3 versioning so all access is recoverable and auditable.

Answer

Store the AWS access keys for the SageMaker role inside the training script and rotate them monthly.

Answer

Enable Amazon Macie on the bucket and rely on its findings alone to prevent unauthorized read access.