DEA-C01 Data Operations and Support Practice Question
A data engineering team uses Amazon S3 to store raw data files. They have an AWS Glue ETL job that reads from an S3 bucket, transforms the data, and writes to a Redshift cluster. The job runs daily and has been failing intermittently with the error: 'An error occurred while calling o143.pyWriteDynamicFrame. S3 Access Denied'. The team has confirmed that the IAM role used by the Glue job has s3:GetObject and s3:PutObject permissions on the bucket and all objects. The Redshift cluster is in the same VPC and the Glue connection is configured correctly. What is the most likely cause of the failure?
⚠ Common exam trap
The trap is focusing on the source bucket permissions and Redshift connectivity while overlooking that Glue requires separate permissions for its temporary staging bucket, which is a frequent cause of 'S3 Access Denied' errors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Glue job's IAM role lacks permission to write to the Glue temporary file bucket (aws-glue-*).
AWS Glue writes intermediate data to a temporary S3 bucket (aws-glue-* in the same region) before loading into Redshift. Even though the job has S3 permissions on the source bucket, the IAM role must also have s3:GetObject, s3:PutObject, and s3:DeleteObject on the Glue temporary bucket. The 'S3 Access Denied' error during pyWriteDynamicFrame indicates the write to this temp bucket is failing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Redshift cluster is not publicly accessible and the Glue job does not have a VPC endpoint to Redshift.
Why it's wrong here
The error names pyWriteDynamicFrame, a Glue write operation, so the failure lies in S3 access, not Redshift connectivity; a missing VPC endpoint would surface as a JDBC or connection timeout instead. VPC endpoints are the right fix when a Glue job in a private subnet must reach Redshift without NAT.
- ✗
The Glue job has exceeded the maximum execution time and is being killed by AWS.
Why it's wrong here
Timeout termination reports a job timeout or execution-time error, not S3 Access Denied. It is tempting because intermittent daily failures can stem from long runtimes, but the explicit S3 denial indicates a permissions or bucket-policy problem affecting the Glue role's access to the source or temporary bucket.
- ✗
The Glue job is using the wrong JDBC driver version for Redshift.
Why it's wrong here
A JDBC driver mismatch produces connection or SQL errors, not an S3 Access Denied message during pyWriteDynamicFrame. It is tempting because Redshift connectivity issues do cause Glue job failures, but the error names S3, so the cause lies in S3 permissions or bucket policy, not the driver.
- ✓
The Glue job's IAM role lacks permission to write to the Glue temporary file bucket (aws-glue-*).
Why this is correct
Glue writes intermediate results to its own temporary S3 bucket before loading into Redshift, so the pyWriteDynamicFrame Access Denied arises there, not on the source or target. The role's GetObject and PutObject grants on the data bucket do not cover the aws-glue-* temporary bucket.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer is setting up an AWS Glue job to process data from an Amazon S3 bucket. The job fails with an 'Access Denied' error. Which TWO IAM permissions are MOST likely missing from the Glue job's IAM role?
easy- ✓ A.s3:PutObject
- B.kms:Decrypt
- C.dynamodb:GetItem
- D.glue:StartJobRun
- ✓ E.s3:GetObject
Why A: The Glue job needs to read the source data from the S3 bucket, which requires the s3:GetObject permission on the bucket's objects, so option E is correct. The job also needs to write its output (or intermediate results) back to S3, which requires the s3:PutObject permission, making option A correct. Option B (kms:Decrypt) is not necessarily missing unless the S3 objects are encrypted with a customer-managed KMS key and the role lacks decrypt rights, but the scenario does not state that. Option C (dynamodb:GetItem) is unrelated because the job processes data from S3, not DynamoDB. Option D (glue:StartJobRun) is a permission for triggering jobs, not for the job's execution role to access data, so it is not the cause of the Access Denied error.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.