Exam AWS Certified Machine Learning Engineer - Associate MLA-C01 topic 1 question 99 discussion

The correct answer is A: To prevent the deployment of SageMaker notebook instances that allow root access, the ML engineer should use IAM condition keys. This can be achieved by creating an IAM policy that uses the sagemaker:RootAccess condition key to deny the creation or update of notebook instances when root access is enabled. This solution provides preventive control at the permission level, ensuring non-compliant instances cannot be created in the first place, rather than having to detect and remove them after deployment. Option C: Using EventBridge events with Lambda functions would be less effective because it's a reactive approach that would allow non-compliant instances to be created before deleting them, potentially creating security vulnerabilities during the window between creation and deletion.