MLS-C01 · Question #160
A company is building a predictive maintenance model based on machine learning (ML). The data is stored in a fully private Amazon S3 bucket that is encrypted at rest with AWS Key Management Service…
The correct answer is A. Create an IAM role that has permissions to create Amazon SageMaker Processing jobs, S3 read. The workflow requires: (1) a SageMaker notebook to trigger a Processing job, (2) the Processing job to read from and write to an encrypted S3 bucket, (3) the Processing container image to be pulled from Amazon ECR. To make this work seamlessly, the IAM role must have…
Question
A company is building a predictive maintenance model based on machine learning (ML). The data is stored in a fully private Amazon S3 bucket that is encrypted at rest with AWS Key Management Service (AWS KMS) CMKs. An ML specialist must run data preprocessing by using an Amazon SageMaker Processing job that is triggered from code in an Amazon SageMaker notebook. The job should read data from Amazon S3, process it, and upload it back to the same S3 bucket. The preprocessing code is stored in a container image in Amazon Elastic Container Registry (Amazon ECR). The ML specialist needs to grant permissions to ensure a smooth data preprocessing workflow. Which set of actions should the ML specialist take to meet these requirements?
Options
- ACreate an IAM role that has permissions to create Amazon SageMaker Processing jobs, S3 read
- BCreate an IAM role that has permissions to create Amazon SageMaker Processing jobs.
- CCreate an IAM role that has permissions to create Amazon SageMaker Processing jobs and to
- DCreate an IAM role that has permissions to create Amazon SageMaker Processing jobs.
How the community answered
(36 responses)- A83% (30)
- B3% (1)
- C6% (2)
- D8% (3)
Explanation
The workflow requires: (1) a SageMaker notebook to trigger a Processing job, (2) the Processing job to read from and write to an encrypted S3 bucket, (3) the Processing container image to be pulled from Amazon ECR. To make this work seamlessly, the IAM role must have permissions to: create SageMaker Processing jobs, read from and write to the S3 bucket (s3:GetObject, s3:PutObject), use the AWS KMS CMK to decrypt and re-encrypt data (kms:Decrypt, kms:GenerateDataKey), and pull the container image from ECR (ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, etc.). Option A is the only choice that includes all four required permission categories. Options B, C, and D each omit one or more critical permission sets (KMS access, ECR access, or S3 write access), which would cause the workflow to fail at some stage.
Topics
Community Discussion
No community discussion yet for this question.