A water utility GenAI assistant should answer service FAQs but must not read unrestricted customer billing tables. Which IAM design best enforces that boundary?
Select an answer to reveal the explanation.
Short Explanation
Least privilege is the difference between a front-desk badge and the vault key. The FAQ bot gets the water-service docs it needs—and an explicit “no” on unrestricted billing tables—so a chat session cannot wander into the money room.
Full Explanation
Denying the GenAI execution role access to unrestricted customer billing tables under least privilege is the IAM design that enforces the water utility’s boundary: the assistant may answer service FAQs but must not read unrestricted billing data. The FAQ bot’s role should receive only permissions needed for approved knowledge sources (FAQ corpora, status APIs) and explicit deny or omitted allow on billing tables, warehouses, or finance buckets. Authorization at IAM (and data-plane grants) cannot be replaced by polite system-prompt wording when tools or retrieval can otherwise reach customer financial records.
Attaching PowerUserAccess and relying on prompt wording alone grants broad AWS capabilities and hopes natural language will restrain the model—prompts are not a security boundary against tool misuse or compromised credentials. Storing billing table dumps inside the system prompt places sensitive financial data into every invocation context, logs, and prompt caches. Granting the chatbot the same credentials used by finance ERP administrators equates a public-facing FAQ agent with vault-level access and creates catastrophic blast radius.
Exam caveat: least privilege for FM workloads is tested as IAM/data permissions matching the use case, not as prompt instructions. When a stem contrasts FAQ scope with billing tables, the correct answer is deny/omit billing access for the GenAI role.
Operational check: inventory data sources the water FAQ bot can reach via tools/RAG, confirm billing tables are absent from role policies and Lake Formation/Glue grants, attempt a controlled unauthorized read in a lower environment and expect failure, and review permissions whenever new connectors are added.