All training data for multiple business groups is stored in S3 within a single AWS account. ML engineers must only access the training data for their own business group and must be prevented from accessing other groups' data. All training runs occur in SageMaker. How should the company enforce the required access controls?

Creating IAM policies that restrict access and attaching them to the appropriate IAM users or roles is the correct solution. IAM policies allow granular control over S3 access, enabling you to define specific permissions for each business group, ensuring they can only access their designated training data. This directly addresses the requirement of preventing access to other groups' data. S3 bucket versioning helps recover previous versions of objects but doesn't control who can access them. Configuring S3 Object Lock prevents objects from being deleted or overwritten for a fixed amount of time or indefinitely, which is a data retention and immutability feature, not an access control mechanism for different user groups. Adding CORS policies to S3 buckets controls how web applications in one domain can interact with resources in another domain, which is irrelevant to restricting internal ML engineers' access to S3 data.