Get Your CertAIF-C01PlayCompete
‹ All AIF-C01 questions

AIF-C01 Practice Question 89: Least Privilege Model Access

AWS Certified AI Practitioner (AIF-C01) · Test 9 · question 9 of 10

Security, Compliance, and Governance for AI Solutionseasy

A security team must let an application role call only one approved foundation model on Amazon Bedrock through the API. The role must not be able to invoke any other model. Which approach follows the principle of least privilege?

Select one answer
Show answer and explanation

Answer:

  • A. Attach an IAM policy that allows bedrock:InvokeModel only on that model's ARN.

AWS recommends that you *"grant only the permissions required to perform a task"* by defining *"the actions that can be taken on specific resources."* Bedrock inference actions accept a foundation model ARN as the resource, so an identity-based policy that allows bedrock:InvokeModel (and InvokeModelWithResponseStream if streaming is used) on one model ARN limits the role to that model (option A).

- B is wrong because the full-access managed policy grants far more than needed, and relying on developers to choose the right model is a convention, not an enforced control. - C is wrong because a bucket policy controls access to S3 objects. It has no say over which models a role can invoke. - D is wrong because security groups filter network traffic by IP address, protocol and port. All Bedrock models are served from the same endpoint, so they cannot tell models apart.

The linked page shows the same pattern with a Deny on a foundation model ARN and an Allow on a provisioned model ARN; an Allow scoped to one foundation model uses the same resource element.

Reference: Identity-based policy examples for Amazon Bedrock

Practice Test 9 ›

Study guides for AIF-C01

AI engineer roadmap 2026: skills, certs and the orderAI engineer roadmap for 2026: skills to learn in order, AI engineer vs ML engineer, which certifications fit each stage, and what to skip.
How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.
How AWS Certification Exams Work: Scoring and RenewalHow AWS certification exams work: levels, booking, question types, unscored questions, scaled scores, pass marks, validity and how recertification works.
What Is Amazon Bedrock? Models, Pricing and GuardrailsWhat is Amazon Bedrock? How a request reaches a model, what happens to your data, token pricing, Guardrails, Knowledge Bases, AgentCore and the exam traps.
Google Cloud Generative AI Leader vs AWS AI PractitionerGoogle Cloud Generative AI Leader vs AWS AI Practitioner: format, cost, topics, free preparation and which certification to take first.
AWS certification cost in 2026, and free ways to prepareWhat every AWS certification costs in 2026 in USD and INR, retake and reschedule rules, the 50% voucher, and the free official ways to prepare.
AWS Generative AI Developer Professional (AIP-C01) guideWhat the AWS Certified Generative AI Developer – Professional (AIP-C01) exam covers - format, cost, the five domains, the services, and how to prepare.
Best AI certifications 2026: AWS, Google, Microsoft, ClaudeThe best AI certifications in 2026 from AWS, Google, Microsoft, Claude and Databricks, by level, with price, status and which one to take first.
Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
What Is RAG? How Retrieval-Augmented Generation WorksWhat RAG is and how it works: chunking, embeddings, vector search, hybrid search, reranking, GraphRAG and agentic RAG on AWS, Google and Azure.
Prompt engineering vs RAG vs fine-tuningWhen to use prompt engineering, retrieval-augmented generation, fine-tuning or continued pre-training, compared on cost, freshness, hallucination and privacy.