DEA-C01 IAM Role Permissions Practice Question

A company is using AWS Glue to run ETL jobs that process data from Amazon S3 and load it into Amazon Redshift. The data engineer notices that the Glue job is failing with the error 'S3ServiceException: Access Denied' when writing to the staging S3 bucket. Which TWO actions should the engineer take to resolve this issue?

⚠ Common exam trap

The question asks for two actions, and there are several plausible options. Candidates may be misled into selecting incorrect options such as option C (granting write to the Glue service principal) or option D (read permission for source bucket), which do not directly resolve the write access error.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Verify that the IAM role used by the Glue job has the s3:PutObject permission for the staging bucket.

Options B and E are correct. The Glue job's IAM role must have s3:PutObject permission on the staging S3 bucket (option B). Additionally, the S3 bucket policy must explicitly allow the Glue job's IAM role to perform s3:PutObject (option E). Option C is incorrect because AWS Glue uses the IAM role attached to the job for S3 operations, not the Glue service principal; granting the service principal write access is unnecessary and not a standard practice. Option A is incorrect because the error is a permission issue, not a script path issue. Option D is incorrect because the error is about writing to the staging bucket, not reading from the source bucket.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Ensure that the Glue job script is correctly referencing the S3 bucket path.
Why it's wrong here
Incorrect. The 'Access Denied' error indicates a permission issue, not a script path issue.
✓
Verify that the IAM role used by the Glue job has the s3:PutObject permission for the staging bucket.
Why this is correct
Correct. The IAM role must have s3:PutObject permission on the staging bucket.
✗
Ensure that the S3 bucket has a bucket policy that allows the AWS Glue service principal to write objects.
Why it's wrong here
Incorrect. AWS Glue jobs use the IAM role for S3 access; the Glue service principal is not required for write operations. The bucket policy should allow the IAM role, not the service principal.
✗
Verify that the IAM role has s3:GetObject permission for the source bucket.
Why it's wrong here
Incorrect. The error is about writing to the staging bucket, not reading from the source bucket.
✓
Check the S3 bucket policy for the staging bucket and ensure it allows the Glue job's IAM role to perform s3:PutObject.
Why this is correct
Correct. The S3 bucket policy must explicitly allow the Glue job's IAM role to perform s3:PutObject.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 IAM Role Permissions Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question