How to restrict Amazon Bedrock data access per team?

A company wants to develop a large language model (LLM) application by using Amazon Bedrock and customer data that is uploaded to Amazon S3. The company's security policy states that each team can access data for only the team's own customers. Which solution will meet these requirements?

Create an Amazon Bedrock custom service role for each team that has access to only the team's customer data. Source Reference Answer
Create a custom service role that has Amazon S3 access. Ask teams to specify the customer name on each Amazon Bedrock request.
Redact personal data in Amazon S3. Update the S3 bucket policy to allow team access to customer data.
Create one Amazon Bedrock role that has full Amazon S3 access. Create IAM roles for each team that have access to only each team's customer folders.

Community Votes

71%

29%

71% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests the principle of least privilege applied to Amazon Bedrock's service role — the role Bedrock assumes to access S3 must itself be restricted, because downstream team IAM roles cannot prevent Bedrock from reading data the service role can see.

To enforce team-level data isolation in Amazon Bedrock, create a custom service role per team with S3 permissions scoped to only that team's customer data. This implements least privilege directly at the service role used by Bedrock to read knowledge base data.

Candidates often pick D, assuming team IAM roles on S3 folders are enough. They miss that Bedrock uses its own service role to read S3, so a single Bedrock role with full S3 access would let the model see and potentially expose all customers' data regardless of team IAM permissions.

Community Discussion (11 comments)

HarshulSinghThakur 👍 1

This option ensures that each team has a dedicated service role with permissions specifically tailored to access only their own customer data. This approach aligns with the company's security policy by enforcing strict access controls at the role level, ensuring that teams cannot access data belonging to other teams. By creating separate roles for each team, the solution adheres to the principle of least privilege, which is a fundamental security best practice. This method also simplifies auditing and management of access permissions, as each role's permissions can be reviewed and adjusted independently.

Jessiii 👍 2 Selected: A

A. Create an Amazon Bedrock custom service role for each team that has access to only the team's customer data.: This would require multiple service roles for Amazon Bedrock itself, which could lead to unnecessary complexity and overhead in role management. It's better to use IAM roles to control team-specific data access.

pavankvv 👍 1 Selected: D

By creating a single Bedrock role with full S3 access and then using IAM roles to control access to the customer data folders, the company can meet its requirements for developing the LLM application while also adhering to its security policy.

Moon 👍 2 Selected: A

A: Create an Amazon Bedrock custom service role for each team that has access to only the team's customer data. Explanation: To comply with the company's security policy requiring each team to access only their own customer data, the best approach is to create custom service roles in Amazon Bedrock for each team. These roles should have fine-grained permissions, granting access only to the specific Amazon S3 data (e.g., folders or buckets) associated with each team's customers. This ensures compliance with the principle of least privilege. Wrong: D. Create one Amazon Bedrock role that has full Amazon S3 access. Create IAM roles for each team that have access to only each team's customer folders: Giving Bedrock full S3 access is a major security risk. Even with team-specific IAM roles, the Bedrock role could be exploited to access any data in S3.

may2021_r 👍 1 Selected: A

The correct answer is A. Custom service roles for each team provide granular control over customer data access.

may2021_r 👍 1 Selected: A

A. Create an Amazon Bedrock custom service role for each team that has access to only the team's customer data.

Contactfornitish 👍 3 Selected: D

A. Create an Amazon Bedrock custom service role for each team that has access to only the team's customer data While this restricts data access, managing multiple service roles for Amazon Bedrock per team is unnecessarily complex and does not align with Bedrock’s design of using a single service role. B. Create a custom service role that has Amazon S3 access. Ask teams to specify the customer name on each Amazon Bedrock request Relying on teams to specify the customer name without enforcing access control policies does not guarantee compliance with the security policy. C. Redact personal data in Amazon S3. Update the S3 bucket policy to allow team access to customer data Redacting personal data is helpful for privacy but does not solve the issue of restricting access based on team-specific customer data.

fed6485 👍 1 Selected: A

it has to be A. B, absurd C, would let all teams access all data, even if scrubbed/redacted .. D, it would not solve the problem as Bedrock would have access, know and reply with the full knowledge of all customers, IAM roles for each team won't stop Bedrock from knowing and replying with that data.. A. You can also create a custom service role and customize the attached permissions to your specific use-case. If you use the console, you can select this role instead of letting Amazon Bedrock create one for you. https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-sr.html

Blair77 👍 1 Selected: A

Adherence to Principle of Least Privilege: By creating a custom service role for each team that grants access only to their specific customer data in S3, you ensure compliance with the principle of least privilege. Each team will have the minimum necessary permissions to access only their relevant data. D is wrong.

taka5094 👍 2 Selected: A

Creating a Bedrock role with access to all S3 data violates the principle of least privilege.

jove 👍 3

I think it should be D, one IAM role for the service, and multiple IAM roles for the teams

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

The correct answer is A. Amazon Bedrock accesses customer data in Amazon S3 through a service role that you attach to the model or knowledge base. If the security policy requires that each team can access only its own customers' data, the restriction must be enforced at the service role itself, because that is the identity Bedrock assumes when reading from S3. By creating a custom service role per team with an IAM policy scoped to the specific S3 prefix (folder) containing that team's customer data, you guarantee that Bedrock can only ever retrieve that team's data.

Why the other options fail:

B is incorrect because asking teams to "specify the customer name" in each request does not enforce access control — it relies on user behavior and provides no technical guardrail. Bedrock would still need S3 access governed by the service role.
C is incorrect because redacting data does not solve the access control requirement; teams could still access other teams' (redacted) data, and redaction is not a substitute for IAM-based isolation.
D is the most common trap. It proposes a single Bedrock service role with full S3 access and relies on per-team IAM roles to restrict access. However, Bedrock reads S3 using the service role, not the calling team's IAM role. If the service role has full S3 access, Bedrock can read and potentially surface data from any customer folder, violating the policy. Community comment [8] correctly points out: "IAM roles for each team won't stop Bedrock from knowing and replying with that data."

The key architectural point is that Bedrock's data access is governed by the service role attached to the model/knowledge base, not by the IAM identity of the user invoking the API. Therefore, least privilege must be applied to the service role.

Official Reference

Exam Strategy

When an AWS service accesses your data on your behalf, always identify the service-linked or service role it assumes. Access control must be enforced on that role, not just on the end-user's IAM identity.

Related Analysis

Practice All AIF-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AIF-C01 Practice Test →

← Back to AIF-C01 Study Guide