AWS Certified AI Practitioner AIF-C01 Practice Question

An IAM role supplies temporary security credentials that the SageMaker notebook instance assumes at runtime, allowing it to call S3 and CloudWatch on the user's behalf. IAM users and access keys embed long-term credentials, which the scenario wants to avoid. Policies alone describe permissions but must be attached to a principal such as a role; they cannot be directly attached to the notebook instance. An inline session policy augments permissions for an existing role but still requires that role to exist first.