DEA-C01 Question 415
Single answerYou are working on an AWS Glue ETL job that processes sensitive customer data stored in Amazon S3. To ensure secure access to the S3 bucket, which authentication mechanism should you configure for the Glue job?
- A
Attach an IAM role to the AWS Glue job that grants permissions to access the S3 bucket.
- B
Store the S3 access credentials in the AWS Glue script as environment variables.
- C
Use an AWS Secrets Manager secret to store and retrieve the S3 access credentials.
- D
Manually embed the S3 bucket's access keys directly in the Glue script.
Show answer and explanation
Correct answer: A
Explanation
The recommended approach for granting secure access to resources like S3 in AWS Glue is to attach an IAM role to the Glue job. This ensures that temporary credentials with the least privilege are used, avoiding the risks associated with hardcoding or storing credentials. Other methods, such as using Secrets Manager or environment variables, are not ideal in this scenario.
- A. Correct.
Correct. Attaching an IAM role to the Glue job is the recommended and secure approach to allow the Glue job to access Amazon S3. IAM roles provide temporary security credentials and adhere to the principle of least privilege.
- B. Incorrect.
Incorrect. Storing access credentials as environment variables is not a secure or standard AWS practice for managing authentication.
- C. Incorrect.
Incorrect. While AWS Secrets Manager is a secure way to manage secrets, it is not the recommended method for granting access to an S3 bucket from AWS Glue jobs. Using IAM roles is preferred here.
- D. Incorrect.
Incorrect. Manually embedding access keys in the Glue script is highly insecure and violates AWS best practices for authentication.