DEA-C01 Data Ingestion and Transformation Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::data-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "glue:StartJobRun",
        "glue:GetJobRun"
      ],
      "Resource": "arn:aws:glue:us-east-1:123456789012:job/etl-job"
    }
  ]
}
```

A data engineer has an IAM policy attached to an IAM role used by an AWS Glue job. The Glue job needs to read from S3 bucket 'data-bucket' and write to the same bucket. The job fails with an access denied error when trying to write to S3. What is the issue?

⚠ Common exam trap

A common mix-up: candidates assume only object-level permissions (GetObject, PutObject) are needed for read/write operations, overlooking the bucket-level ListBucket permission that AWS Glue implicitly requires for its internal operations.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not include s3:ListBucket permission, which Glue may need.

AWS Glue jobs require the `s3:ListBucket` permission on the bucket to perform operations like listing objects, even when reading and writing specific keys. Without this permission, the job fails with an access denied error when trying to write, as Glue internally uses `ListBucket` to verify bucket existence and access patterns. The policy attached to the IAM role likely includes `s3:GetObject` and `s3:PutObject` but omits the bucket-level `s3:ListBucket` action, which is necessary for the Glue job to interact with S3 successfully.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The Glue job cannot assume the IAM role because of trust policy.
Why it's wrong here
The exhibit does not mention trust issues.
✓
The policy does not include s3:ListBucket permission, which Glue may need.
Why this is correct
Glue may require ListBucket to navigate the bucket.
✗
The resource ARN for S3 is missing the bucket-level permission.
Why it's wrong here
The resource includes /* which is correct for object operations.
✗
The actions for S3 are incorrect; s3:PutObject is not sufficient.
Why it's wrong here
s3:PutObject is the correct action for writing.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

3 more ways this is tested on DEA-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. An IAM policy is attached to an AWS Glue job. The job needs to read from and write to S3 buckets, and also trigger other Glue jobs. The job is failing with an AccessDenied error when trying to write to a bucket named 'example-bucket'. What is the MOST likely cause?

medium

A.The policy does not include s3:PutObject action.
✓ B.The bucket name in the resource ARN does not match the actual bucket name.
C.The policy uses a resource ARN with a wildcard, which is not allowed.
D.The policy does not allow Glue actions.

Why B: The AccessDenied error when writing to 'example-bucket' most likely occurs because the resource ARN in the IAM policy specifies a different bucket name, causing the S3 service to deny the s3:PutObject action. IAM policies require exact ARN matches for resource-based permissions, and a mismatch between the ARN bucket name and the actual bucket name will result in an implicit deny, even if the action is allowed.

Variation 2. Refer to the exhibit. A data engineer has attached this IAM policy to an AWS Glue job role. The Glue job fails when trying to write transformed data to an S3 bucket located in a different AWS account. What is the most likely reason?

medium

A.The policy does not allow lambda:InvokeAsync
B.The Glue job role does not have permissions to write to S3
✓ C.The policy does not grant s3:ListBucket, and the bucket policy may not allow cross-account access
D.The policy does not include kinesis:DescribeStream

Why C: The IAM policy shown does not include the s3:ListBucket permission, which is required for the Glue job to list objects in the S3 bucket before writing. Additionally, cross-account access requires both the source account's IAM policy (this one) to grant write permissions and the target account's S3 bucket policy to explicitly allow the source account's role, which may not be configured. Without s3:ListBucket, the Glue job cannot verify the bucket's existence or structure, causing the write operation to fail.

Variation 3. A data engineer attached this IAM policy to a Lambda function used to transform data in S3. The function is unable to write output to the bucket. What is the most likely reason?

easy

A.The resource ARN is missing the bucket-level ARN.
B.The policy does not allow the s3:DeleteObject action.
✓ C.The policy does not allow the s3:ListBucket action on the bucket.
D.The policy does not allow the s3:PutObjectAcl action.

Why C: The policy allows GetObject and PutObject on objects, but not the s3:ListBucket action required to check existence or list objects. The function likely needs ListBucket to write or verify.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.