A school district is connecting a student-facing app to foundation-model services and must minimize what that app can do. Which API access pattern best applies least privilege?
Select an answer to reveal the explanation.
Short Explanation
A student app should get a hallway pass to one classroom—not master keys to the whole district office. Least-privilege IAM on the FM invoke path is that hallway pass.
Full Explanation
Least-privilege API access for a school-district student-facing app means granting an IAM role scoped only to the specific Bedrock invoke and related actions and resources the app needs. The app receives a hallway pass to the required foundation-model APIs—not master keys to the district AWS account. That pattern limits blast radius if the app is compromised and keeps student GenAI features auditable under a narrow role. Attaching AdministratorAccess so FM calls never fail on permissions fails least privilege and turns any app bug into an account-wide incident. Reusing a long-lived root account access key stored in the mobile app configuration fails every identity best practice: root keys are unrestricted, long-lived, and unsafe on devices. Allowing the app to assume any IAM role in the account to simplify troubleshooting fails containment—troubleshooting convenience is not a reason for universal assume-role rights. Exam caveat: scope both actions and resources (specific model IDs or inference profiles where supported); related permissions such as needed logging or Knowledge Base retrieve calls should be listed explicitly rather than implied by admin rights. Prefer temporary credentials via the app backend over embedding keys in the student app. Operational check: Review the app role policy for only required bedrock and companion actions; deny admin and wildcard resource where possible; confirm no root or long-lived keys ship in the mobile config; test that unauthorized models and APIs are denied; and monitor CloudTrail for unexpected action attempts from the student-app role.