DEA-C01 Question 472
Select 4You are a data engineer tasked with designing a secure data pipeline on AWS. Your pipeline ingests data into an Amazon S3 bucket, processes it using AWS Glue, and stores the results in an Amazon Redshift cluster. You need to ensure that data is protected from unauthorized access at every stage of the pipeline. Which methods should you implement to achieve this?
- A
Enable server-side encryption (SSE) for the S3 bucket and ensure all objects are encrypted at rest.
- B
Use AWS Glue's IAM service roles to control access to the data being processed.
- C
Make the S3 bucket public to allow unrestricted access for easier data ingestion.
- D
Enable Amazon Redshift cluster encryption using AWS Key Management Service (KMS).
- E
Use VPC endpoints to ensure traffic between AWS services remains within the AWS network.
- F
Grant all AWS Glue jobs full administrator privileges to simplify role management.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Securing data pipelines requires applying security best practices at every stage. This includes encrypting data at rest and in transit, ensuring IAM roles are configured for least privilege, and using VPC endpoints to restrict network-level access. Making resources public or granting overly broad privileges violates these principles, exposing the system to potential security threats.
- A. Correct.
Enabling server-side encryption (SSE) for the S3 bucket ensures that all objects are encrypted at rest, protecting them from unauthorized access.
- B. Correct.
Using AWS Glue's IAM service roles allows granular control over access permissions, ensuring that only authorized entities can process the data.
- C. Incorrect.
Making the S3 bucket public would expose the data to unauthorized access, violating security best practices.
- D. Correct.
Amazon Redshift cluster encryption using AWS Key Management Service (KMS) ensures that data stored in the cluster is encrypted at rest, adding an additional layer of protection.
- E. Correct.
Using VPC endpoints ensures that traffic between AWS services (e.g., S3, Glue, and Redshift) remains within the AWS network, protecting it from unauthorized access over the internet.
- F. Incorrect.
Granting all AWS Glue jobs full administrator privileges violates the principle of least privilege and increases the risk of unauthorized access.