Which control limits who can invoke a model?
Why C is the answer
IAM policies
IAM decides who may call an API. Guardrails act on content.
In detail
- IAM policies decide who may invoke a model.
- Scope policies to specific models.
Use case
An illustrative scenario, not a real incident.
Only one service role may invoke a production model, which an IAM policy enforces.
See it in different ways
flowchart LR A["App in a private subnet"] --> B["VPC endpoint"] B --> C["Amazon Bedrock"] D["IAM policy"] --> C E["KMS key"] --> F["Data at rest"]
sequenceDiagram participant U as User participant I as IAM participant G as Guardrails participant M as Model participant L as CloudTrail U->>I: Is this caller allowed? I->>G: Filter the input G->>M: Safe prompt M-->>G: Output G-->>U: Filtered output I->>L: Records the call
flowchart TD
Q{"What are you limiting?"}
Q -->|"Who may call"| A0["IAM"]
Q -->|"What content passes"| A1["Guardrails"]Key point: IAM decides who may call a model.
Why the other options are wrong
- A. A guardrail denied topic
- That filters content, not callers.
- B. A shorter chunk size in the knowledge base
- Chunk size is unrelated.
- D. A longer system prompt
- A prompt does not control callers.