A company wants to develop a large language model (LLM) application by using Amazon Bedrock and customer data that is uploaded to Amazon S3. The…

This solution correctly implements the principle of least privilege using standard AWS identity and access management (IAM) controls. By creating a unique Amazon Bedrock custom service role for each team, you can attach an IAM policy to each role that grants access only to the specific Amazon S3 prefix or folder containing that team's customer data. When a team performs an operation in Bedrock that requires data access (like model fine-tuning or using a Knowledge Base), Bedrock assumes that team's specific role, thereby inheriting its restricted permissions. This enforces strict, infrastructure-level data segregation that aligns perfectly with the security policy.

1. Amazon Bedrock User Guide: In the context of features that access customer data

such as Knowledge Bases

the official documentation mandates the creation of a service role. It states

"Create an IAM role that gives Amazon Bedrock permission to access your vector database and the S3 bucket containing your data sources." The example policies demonstrate scoping permissions to specific S3 resources. This principle directly supports creating a unique

scoped-down role per team for data segregation.

Source: Amazon Bedrock User Guide

Section: "Create a service role for Knowledge Bases for Amazon Bedrock".

2. AWS IAM User Guide: This guide defines the mechanism used in the correct answer. A service role is an IAM role that a service (like Amazon Bedrock) assumes to perform actions on your behalf. The permissions for the service are determined by the IAM policies attached to that role

not the user who starts the action. This confirms that the service role's permissions are the critical control point.

Source: IAM User Guide

Section: "Role terms and concepts"

Subsection: "AWS service role".

3. AWS Well-Architected Framework - Security Pillar: This framework establishes "grant least privilege" as a fundamental design principle. The correct answer is a direct implementation of this principle. "Grant only the permissions required to perform a task. You should grant permissions for specific actions on specific resources under specific conditions." Creating a role per team with access only to that team's data folder is a textbook example.

Source: AWS Well-Architected Framework - Security Pillar

Whitepaper

Section: "SEC 3: How do you manage identities for people and machines?"

Principle: "Grant least privilege".