DEA-C01 Question 418
Select 2You are designing a data pipeline that ingests sensitive financial data into Amazon S3 for further processing by Amazon EMR. To ensure secure access to the data, you need to configure authentication mechanisms. Which of the following steps should you take to implement an authentication mechanism that provides fine-grained access control and temporary credentials?
- A
Use AWS Identity and Access Management (IAM) roles to grant access to the EMR cluster
- B
Enable S3 bucket policies to restrict access to specific IAM users
- C
Use Amazon EMR Kerberos authentication to secure communication within the cluster
- D
Configure an AWS Cognito User Pool to manage user authentication for the EMR cluster
- E
Use AWS Security Token Service (STS) to generate temporary credentials for applications accessing the S3 bucket
Show answer and explanation
Correct answers: A, E
Explanation
To implement secure and fine-grained access to sensitive data, IAM roles should be used to define permissions and assign them to the EMR cluster. Additionally, AWS STS can be used to generate temporary credentials, ensuring time-limited and secure access for applications accessing the S3 bucket. While other options like S3 bucket policies and Kerberos provide security in specific scopes, they do not fulfill the requirements for fine-grained control and temporary credentials.
- A. Correct.
IAM roles are the recommended way to grant access to AWS resources securely. They allow you to define fine-grained permissions and can be used with services like Amazon EMR to access S3 securely.
- B. Incorrect.
S3 bucket policies can restrict access, but they are not sufficient on their own to implement authentication mechanisms that provide fine-grained access control and temporary credentials.
- C. Incorrect.
Kerberos authentication secures communication within the EMR cluster, but it does not address access to external services like S3 or provide temporary credentials.
- D. Incorrect.
AWS Cognito is primarily used for user authentication in web and mobile apps, and it is not relevant to Amazon EMR cluster authentication.
- E. Correct.
AWS Security Token Service (STS) generates temporary credentials, which are essential for secure, time-limited access to AWS resources like S3.