AIP-C01 · Question #93
A software company is using Amazon Q Business to build an AI assistant that allows employees to access company information and personal information by using natural language prompts. The company…
The correct answer is B. Create a single JSON file named acl.json at the top level of the S3 bucket. Add access control. Amazon Q Business supports ACL (Access Control List) JSON files in S3 data sources to enforce document-level access controls tied to IAM Identity Center groups. Creating a single centralized acl.json at the top level of the S3 bucket and defining all department-to-group access…
Question
A software company is using Amazon Q Business to build an AI assistant that allows employees to access company information and personal information by using natural language prompts. The company stores this information in an Amazon S3 bucket. Each department in the company has a dedicated prefix in the S3 bucket. Each object name includes the S3 prefix of the department that it belongs to. Each department can belong to only a single group in AWS IAM Identity Center. Each employee belongs to a single department. The company configures Amazon Q Business to access data stored in an S3 bucket as a data source. The company needs to ensure that the AI assistant respects access controls based on the user's IAM Identity Center group membership. Which solution will meet this requirement with the LEAST operational overhead?
Options
- ACreate a JSON file named acl.json in each department folder. In each file, create access control
- BCreate a single JSON file named acl.json at the top level of the S3 bucket. Add access control
- CFor each IAM Identity Center group, create a separate permissions set that denies access to all
- DCreate a metadata file named metadata.json at the top level of the S3 bucket. Add an
How the community answered
(22 responses)- A5% (1)
- B77% (17)
- C14% (3)
- D5% (1)
Explanation
Amazon Q Business supports ACL (Access Control List) JSON files in S3 data sources to enforce document-level access controls tied to IAM Identity Center groups. Creating a single centralized acl.json at the top level of the S3 bucket and defining all department-to-group access mappings in one file requires the least operational overhead-there is only one file to create and maintain as departments or groups change. Option A (acl.json in every department folder) achieves the same result but multiplies operational overhead by the number of departments. Option C (deny-based IAM permissions sets) is complex and error-prone, requiring a new permissions set per group that denies all other prefixes. Option D (metadata.json) is used for document attribute filtering in search, not for enforcing IAM Identity Center group-based access control.
Topics
Community Discussion
No community discussion yet for this question.