A company is building a video analysis platform on AWS. The platform will analyze a large video archive by using Amazon Rekognition and Amazon Bedrock. The platform must comply with predefined…

Question

Options

• AConfigure VPC endpoints for Amazon Bedrock model API calls. Implement Amazon Bedrock
• BDefine access control by using IAM with attribute-based access control (ABAC) to map
• CRestrict access to services by using VPC endpoint policies. Use AWS Config to track resource
• DConfigure AWS CloudTrail Insights to analyze API call patterns across accounts and detect

• A
  3% (1)
• B
  72% (26)
• C
  17% (6)
• D
  8% (3)

Explanation

Option B is the correct solution because it delivers end-to-end governance, security, and auditability across Amazon Bedrock, Amazon Rekognition, and the underlying data layer while meeting strict privacy and compliance requirements. Using IAM attribute-based access control (ABAC) allows the company to control access to foundation models and data based on department, role, or workload attributes rather than static permissions. This is critical for controlling FM access patterns at scale. Enforcing specific ModelId and GuardrailIdentifier values with IAM condition keys ensures that only approved models and guardrails are used, which directly supports secure model I/O and governance requirements. Configuring VPC endpoints for Amazon Bedrock ensures that all model invocations remain on private AWS network paths, reducing data exfiltration risk and supporting privacy standards. AWS CloudTrail captures both management and data events, providing a definitive audit trail of who accessed which resources and when. Sending logs to CloudTrail Lake enables centralized, long- term, queryable auditing across services. Amazon S3 server access logging adds file-level visibility into video archive access, which is essential for compliance and forensic analysis. Amazon CloudWatch alarms provide near real- time detection of anomalous or unauthorized activity across Amazon Bedrock, Amazon Rekognition, and AWS KMS.

No community discussion yet for this question.