DEA-C01 Data Store Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Embed the AWS access key and secret key directly in the Glue job script.

  Why it's wrong here

  Hardcoding credentials in scripts is a security risk and violates best practices. Credentials can be exposed in logs, version control, or to unauthorized users. This method is not secure and should be avoided. IAM roles eliminate the need for hardcoded credentials and provide temporary credentials automatically.

• ✓

  Create an IAM role with the necessary S3 permissions and attach it to the AWS Glue job.

  Why this is correct

  AWS Glue jobs assume an IAM role that grants permissions to access AWS resources. By attaching a role with the appropriate S3 permissions, the job can securely access the bucket without embedding credentials. This is the recommended best practice for AWS services. It also allows for fine-grained access control and auditing.

• ✗

  Store AWS credentials in AWS Secrets Manager and retrieve them within the Glue job script.

  Why it's wrong here

  While Secrets Manager securely stores credentials, retrieving them in the Glue job still requires code to access the secret and may expose credentials in memory. It adds unnecessary complexity compared to using an IAM role. IAM roles are the native and preferred method for granting AWS services access to resources. This approach is less secure and more operationally intensive.

• ✗

  Use an Amazon S3 bucket policy that allows public read access to the data.

  Why it's wrong here

  Granting public read access to the S3 bucket is a severe security risk and exposes data to unauthorized parties. It does not provide secure access for the Glue job specifically. The engineer should use IAM roles to grant least privilege access. Public access is never the right solution for secure data processing.

Go deeper

Related to this question