A model-artifact bucket looks private in the ACL, but its bucket policy still allows Principal "*" on a report prefix and allows non-TLS gets. IAM roles already look tight. What should they apply?
Select an answer to reveal the explanation.
Short Explanation
The ACL looks private, but the bucket policy still allows Principal * and non-TLS gets. Deny public principals and require TLS. Tight IAM does not cancel that allow, and Model Monitor is not a public-access control.
Full Explanation
A bucket policy should deny public principals and require aws:SecureTransport for ML artifacts. Tight IAM does not cancel a Principal "*" allow or HTTP gets. Comprehend is not that policy, and Model Monitor is not a public-access control.