Choosing Credentials to Access Foundation Models
Explore how to choose appropriate credentials to access foundation models in AWS SageMaker. Understand the differences between IAM roles and Amazon Bedrock API keys, their use cases, and how to securely scope and govern each credential type for production and exploration workloads.
The previous lesson built a layered security design for SageMaker workloads: execution roles with least-privilege policies, private subnets, PrivateLink endpoints, hardened pipelines, and audit logging. One identity decision is still open. When an application calls a foundation model (FM), which credential should it present?
Applications that call FMs through Amazon Bedrock, which the course covers in depth in the Managed AI and generative AI Solutions chapter, need credentials just like a SageMaker training job does. Bedrock accepts both standard IAM credentials and its own API keys, and the exam expects you to match the credential type to the environment.
In this lesson, you will compare IAM roles with short-term and long-term Amazon Bedrock API keys, scope access to a single model, and use IAM to restrict, audit, and revoke API keys. ...