A harbor surveyor’s IAM user is attached as the role the training job assumes. When that user is deactivated, jobs fail; while it is active, the job inherits console-admin rights. What should they use?
Select an answer to reveal the explanation.
Short Explanation
The surveyor's IAM user is attached as the role the training job assumes. Use a dedicated SageMaker execution role for jobs and endpoints, and a separate role for humans. Binding the job to a console user couples deactivation to failures and over-grants admin.
Full Explanation
Jobs and endpoints assume a dedicated SageMaker execution role. A human user or role is separate and must not be reused as the job role. Binding the job to a console user couples deactivation to failures and over-grants admin rights. Translate is not that split, and anonymous access is the opposite of least privilege.