DEA-C01 Data Security and Governance Practice Question
A data engineer is configuring an AWS Glue ETL job that reads from an Amazon S3 bucket containing sensitive customer records. The security team requires that the job's data be encrypted at rest using a customer managed AWS KMS key, and that the key policy restrict usage to the specific IAM role used by the Glue job. The engineer has already created the KMS key and attached the necessary IAM policy to the Glue job role. What additional step is required to ensure the Glue job can decrypt the S3 data using the customer managed key?
⚠ Common exam trap
The trap here is assuming that an IAM policy granting KMS actions is sufficient, when the KMS key policy must also grant those actions for a customer managed key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a KMS key policy statement granting kms:Decrypt and kms:GenerateDataKey permissions to the Glue job's IAM role.
A customer managed KMS key requires that both the IAM policy of the calling principal and the KMS key policy grant the necessary permissions. The IAM policy alone is insufficient; the key policy must explicitly allow the Glue job's IAM role to use the key for decryption and data key generation. Without this key policy statement, the Glue job cannot decrypt the S3 objects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a KMS key policy statement granting kms:Decrypt and kms:GenerateDataKey permissions to the Glue job's IAM role.
Why this is correct
The KMS key policy must explicitly allow the Glue job's IAM role to perform kms:Decrypt and kms:GenerateDataKey. Even if the IAM policy on the role grants these actions, the key policy is the primary access control for KMS keys and must also grant them. Without this, the Glue job will receive an AccessDenied error when attempting to read the encrypted S3 objects.
- ✗
Configure the S3 bucket to use SSE-S3 instead of SSE-KMS, because Glue cannot use customer managed keys.
Why it's wrong here
AWS Glue fully supports SSE-KMS with customer managed keys for reading and writing data in Amazon S3. Switching to SSE-S3 would remove the ability to use a customer managed key and would not meet the requirement for a customer managed key. SSE-S3 uses AWS managed keys, which cannot be restricted via a custom key policy, so this option fails the security requirement.
- ✗
Enable AWS CloudTrail logging for the KMS key to allow Glue to decrypt the data.
Why it's wrong here
Enabling CloudTrail logging for a KMS key records API calls made to the key but does not grant any permissions. It is an auditing feature, not an access control mechanism. The Glue job still needs explicit kms:Decrypt and kms:GenerateDataKey permissions in the key policy. CloudTrail logging alone will not allow decryption and will not resolve an AccessDenied error.
- ✗
Attach an S3 bucket policy that grants the Glue job role s3:GetObject and s3:PutObject permissions.
Why it's wrong here
An S3 bucket policy granting object-level permissions is necessary for accessing the objects, but it does not grant permission to use the KMS key for decryption. The KMS key policy is a separate resource-based policy that controls access to the key itself. Without a key policy statement allowing the Glue role, the job cannot decrypt the data even if it can read the S3 object.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,321-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.