DEA-C01 Question 448
Select 2You are designing a data pipeline that processes sensitive customer data using Amazon Redshift and Amazon S3. To ensure proper authorization, the Redshift cluster needs access to the S3 bucket to load data securely. Which of the following actions should you take to meet this requirement?
- A
Attach an AWS Identity and Access Management (IAM) role with the required S3 permissions to the Redshift cluster.
- B
Create an IAM user with S3 access and provide its credentials to the Redshift cluster.
- C
Ensure the S3 bucket policy grants access to the Redshift cluster's IAM role.
- D
Enable AWS Key Management Service (KMS) encryption on the S3 bucket.
- E
Configure an EC2 instance to act as a proxy for Redshift to access the S3 bucket.
Show answer and explanation
Correct answers: A, C
Explanation
To enable Amazon Redshift to securely access Amazon S3, you should attach an IAM role with the necessary S3 permissions to the Redshift cluster. Additionally, the S3 bucket policy must grant access to this IAM role to ensure proper authorization. This approach adheres to AWS's least-privilege and best-practice security principles.
- A. Correct.
This is correct. Attaching an IAM role with the appropriate S3 permissions to the Redshift cluster is the recommended and secure way to grant access.
- B. Incorrect.
This is incorrect. Providing IAM user credentials to Redshift is not a secure or recommended best practice for granting access.
- C. Correct.
This is correct. The S3 bucket policy must explicitly allow the Redshift cluster's IAM role to access the bucket.
- D. Incorrect.
This is incorrect. While enabling KMS encryption enhances data security, it doesn't address the authorization mechanism required for Redshift to access S3.
- E. Incorrect.
This is incorrect. Using an EC2 instance as a proxy is unnecessary and introduces complexity without addressing the authorization requirement.