Question

A financial services company runs multiple machine learning teams on Amazon SageMaker. The security team requires that each team's data scientists can only launch training jobs and access specific S3 buckets tied to their project, without granting broad access to all SageMaker resources or unrelated data. A compliance auditor also needs to verify exactly what each role is permitted to do. Which approach best meets these requirements?

Accepted Answer

Create scoped IAM roles that grant only the SageMaker actions and S3 bucket access each project requires, following the principle of least privilege.

Answer

Attach the AWS managed AmazonSageMakerFullAccess policy to every data scientist so they can use all SageMaker features without interruption.

Answer

Share a single set of long-lived IAM access keys among all teams and rotate them monthly.

Answer

Enable server-side encryption on the S3 buckets so that only authorized teams can read the training data.