DEA-C01 Data Operations and Support Practice Question
A data engineer is setting up an AWS Glue job to process data from an Amazon S3 bucket. The job fails with an 'Access Denied' error. Which TWO IAM permissions are MOST likely missing from the Glue job's IAM role?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:PutObject
The Glue job needs to read the source data from the S3 bucket, which requires the s3:GetObject permission on the bucket's objects, so option E is correct. The job also needs to write its output (or intermediate results) back to S3, which requires the s3:PutObject permission, making option A correct. Option B (kms:Decrypt) is not necessarily missing unless the S3 objects are encrypted with a customer-managed KMS key and the role lacks decrypt rights, but the scenario does not state that. Option C (dynamodb:GetItem) is unrelated because the job processes data from S3, not DynamoDB. Option D (glue:StartJobRun) is a permission for triggering jobs, not for the job's execution role to access data, so it is not the cause of the Access Denied error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
s3:PutObject
Why this is correct
Writing transformed output back to Amazon S3 requires s3:PutObject on the target prefix. Without it, the Glue job's write stage returns Access Denied even when reading succeeds, so this permission must be added to the job's IAM role.
- ✗
kms:Decrypt
Why it's wrong here
KMS decrypt permission is only needed when the S3 objects are encrypted with a customer-managed AWS KMS key; the stem gives no encryption detail, so this cannot be the missing permission. It is tempting because Glue does call kms:Decrypt for SSE-KMS data, and that would be correct if the bucket used such keys.
- ✗
dynamodb:GetItem
Why it's wrong here
dynamodb:GetItem permits reading DynamoDB tables and has no bearing on S3 object access, so it cannot fix an Access Denied error from a Glue job reading S3. It is tempting because Glue jobs often use DynamoDB, and it would be the correct choice if the job needed to read a DynamoDB table.
- ✗
glue:StartJobRun
Why it's wrong here
glue:StartJobRun launches a job but grants no access to S3 objects, so it cannot resolve an Access Denied error during reading or writing. It is tempting because the job is failing, and it would be the correct choice if the role could not start the job at all.
- ✓
s3:GetObject
Why this is correct
Reading source objects from Amazon S3 requires s3:GetObject on the bucket path. Without it, the Glue job cannot retrieve input data and fails immediately with Access Denied, making this permission essential for the job's IAM role.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.