A data scientist using an Amazon SageMaker notebook instance needs secure access to objects in a specific S3 bucket. What is the recommended way to grant the notebook secure access to that S3 bucket?

The correct approach is to attach an IAM policy to the notebook's execution role. When you create a SageMaker notebook instance, you specify an IAM role that the instance assumes. This execution role dictates what AWS resources the notebook instance can access. By attaching an IAM policy that grants s3:GetObject, s3:PutObject, and s3:ListBucket permissions on the specific S3 bucket to this role, you provide secure and granular access. Incorrect options: An S3 bucket policy can grant access, but it's less common for SageMaker notebook instances. The IAM role is the primary mechanism for controlling permissions for compute resources like SageMaker. Encrypting S3 objects with a customer-managed KMS key only the notebook owner can use doesn't grant S3 access; it only controls decryption. The notebook still needs S3 permissions to retrieve the encrypted objects. Using a lifecycle configuration script to set up AWS CLI with access keys is insecure. Storing credentials directly on the instance or in scripts is a security anti-pattern and violates the principle of least privilege. IAM roles provide a more secure and manageable way to grant temporary credentials.