DEA-C01 Question 473
Select 3You are a data engineer responsible for designing a secure data pipeline in AWS. The pipeline ingests data into Amazon S3, processes it using AWS Glue, and stores the results in Amazon Redshift. To ensure the data is protected from unauthorized access across these services, which of the following methods should you implement?
- A
Use IAM policies to grant least privilege access to users and services interacting with the pipeline.
- B
Enable S3 bucket policies with public read access for simpler data sharing.
- C
Encrypt data at rest using AWS Key Management Service (AWS KMS) across S3, Glue, and Redshift.
- D
Use VPC endpoints to restrict data communication between services within the AWS network.
- E
Disable logging for services like S3 and Redshift to reduce overhead and cost.
Show answer and explanation
Correct answers: A, C, D
Explanation
To protect data from unauthorized access across AWS services, you should follow AWS best practices such as implementing least privilege access using IAM policies, encrypting data at rest and in transit, and using VPC endpoints to ensure secure communication. Avoid practices that expose your data unnecessarily, such as enabling public access or disabling logging, as they compromise security and reduce accountability.
- A. Correct.
Correct: IAM policies are essential for granting least privilege access, ensuring that only authorized users and services can interact with the pipeline.
- B. Incorrect.
Incorrect: Enabling S3 bucket policies with public read access exposes your data to unauthorized access and is not a secure practice.
- C. Correct.
Correct: Encrypting data at rest using AWS KMS ensures that your data is protected, even if physical disks are stolen or compromised.
- D. Correct.
Correct: Using VPC endpoints ensures that data communication between services happens within the AWS network, avoiding exposure to the public internet.
- E. Incorrect.
Incorrect: Disabling logging reduces visibility into access and activity, making it harder to detect unauthorized access or troubleshoot security issues.