Exams / AIP-C01 / Study guide / Secure access to models and data (federation, RBAC, least privilege)
Secure access to models and data (federation, RBAC, least privilege): AIP-C01 study notes and practice questions
What to know about Secure access to models and data (federation, RBAC, least privilege) for the AIP-C01 exam, from the Implementation and Integration domain (26% of the exam guide), then 1 free question to test it. Part of the AIP-C01 study guide.
AIP-C01 tests whether you can give the right people and services access to models and data without broad permissions. Most questions hinge on one identity source, one IAM condition key, or one place where permissions must be checked.
Limiting model access with IAM
Identity and access management for Amazon Bedrock authorizes calls against model and inference profile resources. A policy can let one team invoke specific model IDs and deny the rest. Inference profiles are their own resources, so a policy that allows an inference profile must also allow the foundation model resources in the Regions the profile can route to.
To force every request through a safety control, use the bedrock:GuardrailIdentifier condition key on invocation actions. The caller can invoke a model only when the request names the approved guardrail, so a developer cannot skip the PII guardrail by omitting it.
For many teams, use attribute-based access control. Tag application inference profiles with team or cost-center values, then write one policy that matches aws:PrincipalTag to aws:ResourceTag. New teams get access by tagging, without policy edits.
Identity for people and applications
Employees sign in through IAM Identity Center, which federates to a corporate identity provider and maps users to permission sets. Users get temporary credentials.
External customers sign in to an Amazon Cognito user pool. An API Gateway Cognito authorizer checks the token, and a backend Lambda function calls Bedrock with its own role. Browser and mobile apps never hold AWS access keys.
Document permissions in retrieval
A model must not reveal documents the user cannot read. Store the allowed groups or user IDs as metadata on each document, then have the application pass a filter built from the caller’s identity into the retrieval call. Enforce the filter in the retrieval request. A line in the system prompt is not an access control, because the model can be tricked into ignoring it.
How to choose
Scenario wording
Choose
“Employees sign in with the corporate directory”
IAM Identity Center with federation
“Customers of a web or mobile chat app”
Cognito user pool and API Gateway authorizer
“Only the GenAI team’s role may use one model”
IAM policy scoped to the model or profile ARN
“Every call must use the PII guardrail”
Condition key bedrock:GuardrailIdentifier
“Access and cost per team, no policy edits per team”
ABAC with tags on application inference profiles
“Answers must hide documents a user cannot see”
Metadata filter from caller identity on retrieval
Common traps
Long-lived access keys embedded in a browser or mobile app, instead of Cognito and temporary credentials.
Prompt-only restrictions such as “do not reveal confidential files”. Access control belongs in IAM and retrieval filters.
Broad bedrock: permissions* granted for convenience to a developer or application role.
Allowing the inference profile but not the foundation models behind it, which causes access denied errors in other Regions.
One IAM user per end customer, which does not scale and is hard to revoke.
A consulting firm runs its generative AI platform in one AWS account. Several teams build internal assistants on Amazon Bedrock, and each team's workloads run under its own IAM role. The marketing team's role must use only three approved foundation models, one text model and two embedding models, which the firm's risk committee has reviewed.
The firm does not want separate AWS accounts for each team, and the restriction must hold for any caller that assumes the marketing role, including code that calls the SDK directly. A new team must not inherit the marketing role's access.
The platform team wants the tightest control at the IAM layer.
Which policy design meets these requirements?
Choose one answer.
AA. Attach the AWS managed policy for full Amazon Bedrock access to the marketing role, and rely on the assistant's code to call only the three approved model IDs.
BB. Create a separate AWS account for the marketing team, and let that account's role invoke only the models enabled in that account, with no policy changes in the shared account.
CC. Grant bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream only on the ARNs of the three approved foundation models, with no statement for other models.
DD. Put an Amazon API Gateway REST API in front of Amazon Bedrock, and use a Lambda authorizer that reads the model ID from each request body and allows only the approved models.
Show the answer and explanation
Answer: C
A. Wrong: Full access lets any caller invoke any model, so the restriction depends on application code that can be changed or bypassed. This fails the requirement that the restriction hold for any caller of the role.
B. Wrong: Separate accounts can limit models, but the firm wants to avoid per-team accounts. The shared account would also keep its wider access for other roles, so the team's boundary is not enforced there.
D. Wrong: The gateway checks requests only when callers use it, so a direct call with the marketing role to Amazon Bedrock is not limited. The custom authorizer also adds code the platform team must maintain.
Explanation
Listing only the approved model ARNs in the IAM policy makes every other model denied by default, for any caller that assumes the marketing role. Separate accounts, full-access policies with code checks and a gateway in front of the service each leave a path around the restriction or add work the firm wants to avoid.
Want more on Secure access to models and data (federation, RBAC, least privilege)? The 5 full-length practice sets have 5 more Secure access to models and data (federation, RBAC, least privilege) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Secure access to models and data (federation, RBAC, least privilege)