DEA-C01 Question 463
Select 3A data engineering team is building a pipeline to process large datasets in AWS. They use Amazon S3 to store raw data, AWS Glue for data transformation, and Amazon Redshift for analytics. To adhere to the principle of least privilege, which of the following actions should they take when configuring IAM roles and policies?
- A
Grant the AWS Glue service role full access to all S3 buckets in the account.
- B
Create a specific IAM policy that allows the AWS Glue service role access only to the required S3 bucket and key prefixes.
- C
Assign an IAM policy to the Amazon Redshift cluster that restricts access to only the tables needed for the analytics workload.
- D
Attach the AdministratorAccess policy to the IAM role used by the data engineers to ensure they can troubleshoot any issues.
- E
Enable resource-based policies on S3 buckets to allow access only from the IAM roles used in the pipeline.
Show answer and explanation
Correct answers: B, C, E
Explanation
The principle of least privilege ensures that IAM roles, users, and services are granted only the permissions they require to perform their tasks, minimizing the risk of accidental or malicious misuse. In this scenario, granting precise permissions to the AWS Glue service role and Amazon Redshift cluster, as well as using resource-based policies on S3, helps enforce this principle while securing the pipeline.
- A. Incorrect.
Granting full access to all S3 buckets violates the principle of least privilege. Only the required permissions should be granted to minimize potential security risks.
- B. Correct.
This adheres to the principle of least privilege by granting specific, limited access to only the necessary resources (e.g., specific S3 buckets and prefixes).
- C. Correct.
Restricting access at the table level ensures that Amazon Redshift users or processes can only interact with the data they require, aligning with the principle of least privilege.
- D. Incorrect.
Assigning the AdministratorAccess policy to data engineers provides overly broad permissions and does not follow the principle of least privilege.
- E. Correct.
Resource-based policies on S3 buckets restrict access to specific IAM roles or services, which aligns with the principle of least privilege by limiting access to only the necessary resources.