A company is developing an application that reads animal descriptions from user prompts and generates images based on the information from the prompts. The application reads a message from an Amazon…

Question

Options

• AAllow the bedrock:InvokeModel action for the Amazon Titan Image Generator resource.
• BAllow the bedrock:Get* action for the Amazon Titan Image Generator resource.
• CAllow the sqs:ReceiveMessage action and the sqs:DeleteMessage action for the SQS queue
• DAllow the sqs:GetQueueAttributes action and the sqs:DeleteMessage action for the SQS queue
• EAllow the sagemaker:PutRecord* action for the Amazon Titan Image Generator resource.

• A
  95% (61)
• D
  2% (1)
• E
  3% (2)

Explanation

The application performs three distinct actions: (1) read a message from SQS, (2) invoke Amazon Titan Image Generator via Bedrock, and (3) delete the message from SQS. Each action requires a specific IAM permission.

• A is correct: bedrock:InvokeModel is the required action to call a Bedrock foundation model such as Amazon Titan Image Generator. Without it, the API call to generate an image will be denied.
• C is correct: sqs:ReceiveMessage is needed to read the message from the queue, and sqs:DeleteMessage is needed to remove it afterward. Both are explicitly needed per the described workflow.

Why the other options are wrong:

• B: bedrock:Get* is a read/metadata action (e.g., retrieving model info), not for invoking a model to generate output. It does not grant inference capability.
• D: sqs:GetQueueAttributes retrieves metadata about the queue (e.g., approximate message count), not the messages themselves. The application needs ReceiveMessage to actually read messages, not GetQueueAttributes.
• E: sagemaker:PutRecord is a SageMaker-specific action for writing to a Feature Store. It has no relevance to Amazon Bedrock or Titan Image Generator.

No community discussion yet for this question.