MLA-C01 Practice Question 80: Tag Based Access Control
AWS Certified Machine Learning Engineer – Associate (MLA-C01) · Test 8 · question 10 of 10
A company has 30 data science teams sharing one AWS account, and new teams are created every month. Every data scientist's IAM role carries a team tag. The security team requires that data scientists can stop, update, and delete only the training jobs and endpoints that belong to their own team. Administrators do not want to edit IAM policies whenever a team or resource is added.
Which approach meets these requirements?
Show answer and explanation
Answer:
This is attribute-based access control (ABAC). A single policy lets a principal act on a resource when the principal's tag matches the resource's tag. For SageMaker AI, the policy requires the aws:RequestTag/team value on create calls to equal ${aws:PrincipalTag/team}, so every new resource is stamped with the creator's team. It then allows stop, update, and delete actions only when sagemaker:ResourceTag/team equals ${aws:PrincipalTag/team}. New teams need only a tagged role, and new resources are covered automatically, so nobody edits policies (option A).
- B is wrong because resource-specific, role-based policies must be updated every time a resource is created, which AWS names as the main drawback that ABAC removes. - C is wrong because it still needs one policy per team, so every new team means a new policy. Name prefixes are also only a convention: nothing stops a user from creating a job whose name carries another team's prefix. - D is wrong because a multi-account restructure is a large operational change for an access control problem that one tag-based policy solves inside the existing account.
Reference: Define permissions based on attributes with ABAC authorization