Question

A financial services company has fine-tuned a custom model in Amazon Bedrock within a central 'ML platform' AWS account. The governance team requires that three separate business-unit accounts be granted controlled access to invoke this fine-tuned model, while ensuring the model artifacts are never copied out of the platform account and that all sharing is centrally managed and revocable. Which approach BEST meets these governance requirements?

Accepted Answer

Share the fine-tuned model with the business-unit accounts using AWS Resource Access Manager (RAM), then grant IAM permissions in each consuming account to invoke the shared model via a provisioned throughput profile.

Answer

Export the fine-tuned model artifacts to an S3 bucket and copy them into each business-unit account, then re-import the model into each account's Bedrock environment.

Answer

Create IAM users in the platform account for each business unit and distribute long-lived access keys so they can invoke the model directly.

Answer

Make the fine-tuned model publicly accessible by attaching a resource policy that allows the wildcard principal, relying on network ACLs to restrict which accounts can reach it.