How should an application get least-privilege access to Amazon Bedrock?
Why C is the answer
An IAM role with only the permissions it needs
Use IAM roles and narrow permissions.
In detail
- An IAM role with only the needed permissions gives least privilege.
- Roles avoid long-lived keys.
Use case
An illustrative scenario, not a real incident.
An app needs only one model, so its IAM role can invoke that one model and nothing else.
See it in different ways
flowchart TD A["AWS: security of the cloud"] --> B["Infrastructure and managed services"] C["Customer: security in the cloud"] --> D["Data, access and application"]
mindmap
root((Governance))
Who did what
CloudTrail
How it is configured
AWS Config
Sensitive data
Macie
Compliance reports
Artifact
Access
IAM rolesflowchart LR S0["Create role"] --> S1["Allow only needed actions"] --> S2["Attach to the app"]
Key point: Use a narrow IAM role.
Why the other options are wrong
- A. A password stored in the source code
- Code should not hold secrets.
- B. Admin rights for every application, reviewed once each year by the security team
- Admin rights are too broad.
- D. The root user's access keys
- Root keys should not be used.