DEA-C01 Data Security and Governance Practice Question

Network Topology

Refer to the exhibit. A data engineer runs the AWS CLI command and gets the output shown. The engineer wants to grant a data analyst read-only access to the 'sales_db' database in AWS Glue Data Catalog using IAM. Which IAM policy statement is required?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

{"Effect": "Allow", "Action": "glue:GetDatabase", "Resource": "arn:aws:glue:us-east-1:123456789012:database/sales_db"}

To grant read-only access to a database in AWS Glue Data Catalog, the required IAM action is glue:GetDatabase. Option B correctly specifies this action and targets the specific database resource. Option A uses glue:GetTable, which is for tables, not databases. Option C uses glue:GetDatabases, which is for listing databases and requires broader permissions. Option D uses s3:GetObject, which is for S3 data access, not Glue catalog operations.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
{"Effect": "Allow", "Action": "glue:GetTable", "Resource": "arn:aws:glue:us-east-1:123456789012:table/sales_db/*"}
Why it's wrong here
Grants table access, not database.
✓
{"Effect": "Allow", "Action": "glue:GetDatabase", "Resource": "arn:aws:glue:us-east-1:123456789012:database/sales_db"}
Why this is correct
Grants read access to the specific database.
✗
{"Effect": "Allow", "Action": "glue:GetDatabases", "Resource": "*"}
Why it's wrong here
Grants list access, not read on a specific database.
✗
{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::data-lake-sales/*"}
Why it's wrong here
S3 permission, not Glue.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question