DEA-C01 Data Security and Governance Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/DataEngineerRole"
      },
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "s3.us-east-1.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "kms:*",
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Refer to the exhibit. A data engineer is troubleshooting a permissions issue. The IAM role 'DataEngineerRole' is used by an AWS Glue job that needs to read data from an S3 bucket encrypted with a customer managed KMS key. The above key policy is attached to the KMS key. The Glue job fails with an AccessDenied error when trying to read the data. What is the MOST likely cause?

⚠ Common exam trap

AWS often tests the nuance that `kms:ViaService` only applies when the KMS API call is made through the specified service's endpoint, not when a service like Glue calls KMS directly to decrypt an S3 object's key.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The key policy condition 'kms:ViaService' restricts KMS actions to only when they are made through S3, but AWS Glue calls KMS directly, not via S3.

The key policy includes a condition `kms:ViaService` that restricts KMS actions to only when they are made through the S3 service. However, AWS Glue does not call KMS via S3; it calls KMS directly to decrypt the S3 object's data key. Because the Glue job's KMS request does not originate from the S3 service, the condition fails, resulting in an AccessDenied error.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The key policy requires requests to originate from a VPC endpoint, but the Glue job is not using one.
Why it's wrong here
The policy does not reference VPC endpoints; it references kms:ViaService.
✗
The key policy denies requests that are not using HTTPS, but the Glue job is using HTTPS.
Why it's wrong here
The Deny statement with SecureTransport=false would deny non-HTTPS; if HTTPS is used, it's allowed.
✓
The key policy condition 'kms:ViaService' restricts KMS actions to only when they are made through S3, but AWS Glue calls KMS directly, not via S3.
Why this is correct
Glue does not use S3 to make KMS calls; it calls KMS directly, so the condition fails.
✗
The Glue job is running in a different AWS region than the S3 bucket.
Why it's wrong here
The kms:ViaService condition restricts the AWS service making the request, not the caller's region.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

3 more ways this is tested on DEA-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. A data engineer is running an AWS Glue job that reads from an S3 bucket encrypted with a customer-managed KMS key. The job fails with the error shown. What is the most likely cause?

hard

A.The S3 bucket policy denies the kms:Decrypt action.
✓ B.The IAM role used by the Glue job is missing the kms:Decrypt permission.
C.The Glue job does not have permission to call kms:GenerateDataKey.
D.The KMS key policy does not grant the Glue service principal access.

Why B: The error indicates that the AWS Glue job cannot access the S3 bucket because it lacks the necessary KMS permissions. Since the bucket is encrypted with a customer-managed KMS key, the IAM role assigned to the Glue job must include the kms:Decrypt permission to read the encrypted objects. Without this permission, the job fails when attempting to decrypt the data.

Variation 2. A data engineer is troubleshooting an issue where an AWS Glue ETL job fails when trying to read data from an S3 bucket encrypted with SSE-KMS. The job has an IAM role that includes `kms:Decrypt` permission. What is the most likely reason for the failure?

medium

A.The IAM role does not have s3:GetObject permission
✓ B.The KMS key policy does not allow the Glue job to use the key
C.The S3 bucket is in a different AWS region than the Glue job
D.The Glue job is not configured to use the KMS key for decryption

Why B: The most likely reason for the failure, even with kms:Decrypt permission in the IAM role, is that the KMS key policy explicitly denies the Glue job's IAM role access to the key. AWS Glue ETL jobs can read SSE-KMS encrypted S3 objects without additional configuration; the job's IAM role must be allowed by the key policy. Option A is incorrect because the IAM role likely has s3:GetObject permission. Option C is incorrect because cross-region S3 access is permitted with proper permissions. Option D is incorrect because Glue does not require explicit KMS key configuration for reading; the key is identified in the S3 object metadata, and the job's IAM role is trusted to use the key based on key policy.

Variation 3. A data engineer is troubleshooting an issue where an IAM role used by AWS Glue cannot read data from an S3 bucket encrypted with SSE-KMS. The bucket policy allows the role to perform s3:GetObject. What additional permission is needed?

hard

A.s3:GetObjectVersion
✓ B.kms:Decrypt on the KMS key
C.s3:GetObjectAcl
D.kms:GenerateDataKey on the KMS key

Why B: For SSE-KMS, the IAM role needs kms:Decrypt permission on the KMS key to read encrypted objects. Option A (s3:GetObjectVersion) is not required because the bucket policy already allows s3:GetObject; versioning is not relevant here. Option C (s3:GetObjectAcl) is for access control lists, not encryption. Option D (kms:GenerateDataKey) is used for encrypting new objects, not reading existing ones. Therefore, the correct answer is B.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.