DEA-C01 Data Operations and Support Practice Question
A data engineer is troubleshooting a failed AWS Glue job that writes results to Amazon S3. The error log shows 'AccessDenied' when trying to list the bucket. Which IAM policy statement should the engineer add to the Glue job's role?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:ListBucket
Listing a bucket requires the s3:ListBucket permission. Option B is wrong because s3:PutObject is for writing, not listing. Option C is wrong because s3:DeleteObject is not needed. Option D is wrong because s3:GetObject is for reading objects, not listing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
s3:ListBucket
Why this is correct
The AccessDenied error occurs on the ListBucket operation, which requires the s3:ListBucket permission on the bucket resource itself, not on objects. Adding this action to the Glue job's IAM role grants the missing listing capability.
- ✗
s3:PutObject
Why it's wrong here
s3:PutObject allows writing objects but not enumerating a bucket, so the ListBucket AccessDenied persists. It is tempting because the job's purpose is writing results to S3, and PutObject is the natural write permission. The error is on listing, which requires s3:ListBucket.
- ✗
s3:DeleteObject
Why it's wrong here
s3:DeleteObject permits object removal, not bucket listing, so the AccessDenied on ListBucket persists. It is tempting because Glue jobs often manage S3 output, but deletion is unrelated to enumeration. s3:ListBucket is the action the failing API call requires.
- ✗
s3:GetObject
Why it's wrong here
s3:GetObject authorises reading object data, not listing a bucket's contents, so the ListBucket AccessDenied remains. Engineers reach for it because Glue commonly reads source objects, making it a familiar grant. The failing call is a bucket-level list, which s3:ListBucket covers.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,321-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.