Courseiva
Data Security and GovernancemediumMultiple ChoiceObjective-mapped

DEA-C01 KMS Key Policy Practice Question

A data engineer is troubleshooting an issue where an AWS Glue ETL job fails when trying to read data from an S3 bucket encrypted with SSE-KMS. The job has an IAM role that includes `kms:Decrypt` permission. What is the most likely reason for the failure?

⚠ Common exam trap

Candidates often assume that kms:Decrypt on the IAM role is sufficient, but the KMS key policy is an additional layer that can deny access even when the role has the permission.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The KMS key policy does not allow the Glue job to use the key

The most likely reason for the failure, even with kms:Decrypt permission in the IAM role, is that the KMS key policy explicitly denies the Glue job's IAM role access to the key. AWS Glue ETL jobs can read SSE-KMS encrypted S3 objects without additional configuration; the job's IAM role must be allowed by the key policy. Option A is incorrect because the IAM role likely has s3:GetObject permission. Option C is incorrect because cross-region S3 access is permitted with proper permissions. Option D is incorrect because Glue does not require explicit KMS key configuration for reading; the key is identified in the S3 object metadata, and the job's IAM role is trusted to use the key based on key policy.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The IAM role does not have s3:GetObject permission

    Why it's wrong here

    Incorrect. The IAM role likely has s3:GetObject permission; otherwise the error would be an access denied from S3.

  • The KMS key policy does not allow the Glue job to use the key

    Why this is correct

    Correct. The most likely cause is that the KMS key policy does not grant the Glue job's IAM role permission to use the key. Even with kms:Decrypt in the role, the key policy must allow it.

  • The S3 bucket is in a different AWS region than the Glue job

    Why it's wrong here

    Incorrect. S3 bucket and Glue job can be in different regions as long as the necessary permissions are in place.

  • The Glue job is not configured to use the KMS key for decryption

    Why it's wrong here

    Incorrect. AWS Glue does not require explicit configuration of the KMS key to read SSE-KMS encrypted data; the decryption is handled automatically when the job role has adequate KMS permissions and the key policy allows it.

Quick reference

AWS S3 Storage Class Comparison

Storage ClassMin DurationRetrievalUse Case
S3 StandardNoneImmediateFrequently accessed data
S3 Standard-IA30 daysImmediateInfrequent access, rapid retrieval
S3 One Zone-IA30 daysImmediateNon-critical infrequent data
S3 Intelligent-TieringNoneImmediate–hoursUnknown or changing access patterns
S3 Glacier Instant90 daysMillisecondsArchive with instant retrieval
S3 Glacier Flexible90 daysMinutes–hoursArchive, flexible retrieval
S3 Glacier Deep Archive180 daysHoursLong-term compliance archive

About these practice questions

Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.