AWS Certified AI Practitioner AIF-C01 Practice Question

Attaching a custom inline policy to the SageMaker execution role lets the team explicitly allow s3:GetObject (and any other required actions) only on the chosen bucket ARN while leaving all other actions implicitly denied. The AWS managed policy AmazonS3ReadOnlyAccess permits reads from every bucket, defeating the requirement. Service control policies govern entire AWS accounts, not individual roles, and could still allow unintended access through other permissions in the role. Enabling Amazon Macie helps discover sensitive data but does not enforce access restrictions.