DEA-C01 Question 464
Single answerYou are a data engineer working on an AWS-based data pipeline. Your team uses Amazon S3 to store raw data and AWS Glue for ETL processing. A junior developer requests access to the S3 bucket containing raw data to perform Glue job testing. According to the principle of least privilege, what would be the most appropriate action?
- A
Grant the junior developer full access to the S3 bucket to ensure they can modify, read, and delete files as needed.
- B
Grant the junior developer read-only access to the entire S3 bucket.
- C
Grant the junior developer permissions to access only the specific S3 objects required for the Glue job testing.
- D
Grant the junior developer administrator access to the AWS account to avoid future permission issues.
Show answer and explanation
Correct answer: C
Explanation
The principle of least privilege dictates that users should be granted only the permissions necessary to perform their specific tasks. In this scenario, granting the junior developer access to only the specific S3 objects required for Glue job testing ensures security and minimizes risk, while still enabling them to perform their work effectively.
- A. Incorrect.
This violates the principle of least privilege as it grants excessive permissions beyond what is necessary for Glue job testing.
- B. Incorrect.
While this option limits permissions to read-only, it still provides access to the entire S3 bucket, which may include data not relevant to Glue job testing, violating the principle of least privilege.
- C. Correct.
This adheres to the principle of least privilege by granting the junior developer access only to the specific S3 objects they need for their task, minimizing the potential for accidental or malicious data access.
- D. Incorrect.
Granting administrator access is highly inappropriate and a direct violation of the principle of least privilege as it provides unrestricted access across the AWS account.