DEA-C01 Data Operations and Support Practice Question

A data pipeline uses AWS Glue ETL jobs to process data from Amazon RDS for MySQL to Amazon S3. Recently, the jobs have been failing with the error 'Communications link failure' during the connection phase. The RDS instance is in a private subnet, and the Glue job uses a VPC endpoint for S3. What is the most likely cause?

⚠ Common exam trap

DEA-C01 often tests the misconception that enabling a VPC endpoint for S3 automatically provides network access to other VPC resources like RDS, causing candidates to overlook the need for a separate VPC connection for Glue.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Glue job does not have a network path to the RDS instance because it is not attached to the same VPC subnet.

The most likely cause is that the AWS Glue job does not have a network path to the RDS instance because it is not attached to the same VPC subnet. AWS Glue jobs run in a serverless environment that, by default, is outside the customer's VPC. To connect to a private RDS instance, the Glue job must be configured with a VPC connection that specifies the VPC, subnet, and security group, allowing it to reach the RDS instance. Without this, the JDBC connection fails with 'Communications link failure' during the connection phase.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The RDS database has reached the maximum number of connections.
Why it's wrong here
Exhausted connections produce 'Too many connections' errors, and the failure occurs at connection phase regardless of pool state. It is tempting because connection limits do break Glue jobs, and would be correct if the RDS instance were saturated by concurrent clients rather than unreachable from the Glue subnet.
✗
The Glue job does not have IAM permissions to decrypt the RDS database using AWS KMS.
Why it's wrong here
Missing KMS decrypt permissions produce AccessDenied errors, not a TCP-level communications link failure. It is tempting because IAM misconfiguration commonly breaks Glue jobs, and would be correct if the job connected successfully but failed when reading encrypted RDS data.
✗
The JDBC driver used by Glue is incompatible with the MySQL version.
Why it's wrong here
A driver mismatch typically surfaces as protocol or handshake errors, not a connection-phase communications link failure. It is tempting because version incompatibilities do break Glue JDBC connections, and would be correct if the error appeared after connecting or referenced unsupported authentication.
✓
The Glue job does not have a network path to the RDS instance because it is not attached to the same VPC subnet.
Why this is correct
AWS Glue jobs run inside a VPC only when attached to a subnet; without that attachment they cannot route to a private RDS instance. The S3 VPC endpoint does not provide a path to RDS, so the connection fails during the handshake.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Operations and Support Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question