AIP-C01 practice question 14 of 15

A software company is using Amazon Q Business to build an AI assistant that allows employees to access company information and personal information…

Full set: 127 questions
A software company is using Amazon Q Business to build an AI assistant that allows employees to access company information and personal information by using natural language prompts. The company stores this information in an Amazon S3 bucket. Each department in the company has a dedicated prefix in the S3 bucket. Each object name includes the S3 prefix of the department that it belongs to. Each department can belong to only a single group in AWS IAM Identity Center. Each employee belongs to a single department. The company configures Amazon Q Business to access data stored in an S3 bucket as a data source. The company needs to ensure that the AI assistant respects access controls based on the user's IAM Identity Center group membership. Which solution will meet this requirement with the LEAST operational overhead?
Answer options
A: Create a JSON file named acl.json in each department folder. In each file, create access control entries that specify the IAM Identity Center group that should have access to that department's data. Indicate the location of the JSON file in the Access Control section of the data source settings.
B: Create a single JSON file named acl.json at the top level of the S3 bucket. Add access control entries that map each department's S3 prefix to its corresponding IAM Identity Center group. Indicate the location of the JSON file in the Access Control section of the data source settings. Correct answer
C: For each IAM Identity Center group, create a separate permissions set that denies access to all prefixes in the S3 bucket. Add a StringNotEquals condition key to the permissions set for each group that specifies the department each group is associated with. Attach the permissions sets to the Identity Center groups.
D: Create a metadata file named metadata.json at the top level of the S3 bucket. Add an AccessControlList object to the file that specifies the S3 path of each department's prefix. Specify the IAM Identity Center group that should have access to each department's prefix. Reference the file location in the data source metadata settings.
Correct Answer:
B. Create a single JSON file named acl.json at the top level of the S3 bucket. Add access control entries that map each department's S3 prefix to its corresponding IAM Identity Center group. Indicate the location of the JSON file in the Access Control section of the data source settings.
Explanation

Amazon Q Business uses an access control list (ACL) JSON file stored in the S3 bucket to manage user and group permissions for a data source. For optimal management and minimal operational overhead, a single ACL file should be placed at the top level of the S3 bucket. This file contains entries that map S3 prefixes (representing department folders) to the corresponding IAM Identity Center group IDs. Amazon Q then uses this centralized file to filter search results, ensuring users only see content from their authorized department.

Why Incorrect

A. Creating an acl.json file in each department folder increases operational overhead, as multiple files must be managed and updated instead of a single, centralized one.
C. IAM permissions sets control the Amazon Q service role's access to S3 but do not provide the fine-grained, per-user result filtering required within the Amazon Q application itself.
D. Metadata files (metadata.json) are used for adding custom attributes to documents for filtering and faceting, not for defining user access controls.

References

1. Amazon Q Business User Guide. (2024). Using an Amazon S3 data source. AWS Documentation. Retrieved from https://docs.aws.amazon.com/amazonq/latest/business-use-dg/s3-data-source.html. In the section "User and group access control," it states, "To configure access control for your documents, you create a JSON file that contains your access control information... You store this file in the same S3 bucket as your data source." The examples show a single file mapping prefixes to groups.

Keep practicing

Take the free AIP-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other AIP-C01 practice questions

Scroll to Top