DEA-C01 Question 417
Single answerYou are designing a data pipeline on AWS that ingests sensitive customer data into an Amazon S3 bucket. The pipeline uses Amazon EMR for data processing and Amazon Redshift for analytics. You must ensure that only authorized users and services can access the S3 bucket. Additionally, the authentication mechanism should support temporary credentials for enhanced security. Which approach should you take to meet these requirements?
- A
Use IAM roles to grant Amazon EMR and Amazon Redshift access to the S3 bucket, ensuring temporary credentials are issued.
- B
Attach an S3 bucket policy that allows public access, making it easier for services to access the bucket.
- C
Use IAM user credentials hardcoded into the application to provide access to the S3 bucket.
- D
Use an Amazon S3 pre-signed URL for all services and users to access the S3 bucket.
Show answer and explanation
Correct answer: A
Explanation
The recommended approach for securing access to AWS resources is to use IAM roles, as they provide temporary credentials and follow the principle of least privilege. This method ensures that only authorized entities have access to the S3 bucket while maintaining security and compliance requirements.
- A. Correct.
Correct. Using IAM roles ensures secure authentication with temporary credentials, which is a best practice for granting access to AWS resources like S3.
- B. Incorrect.
Incorrect. Allowing public access to the S3 bucket exposes sensitive data and violates security best practices.
- C. Incorrect.
Incorrect. Hardcoding IAM user credentials is a bad practice, as it increases the risk of credential compromise and does not provide temporary credentials.
- D. Incorrect.
Incorrect. S3 pre-signed URLs are suitable for limited and specific access cases, but they are not ideal for securing ongoing access by multiple services in a data pipeline.