DEA-C01 Data Ingestion and Transformation Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "glue:StartJobRun",
        "glue:GetJobRun"
      ],
      "Resource": "*"
    }
  ]
}

Refer to the exhibit. An IAM policy is attached to a role used by an AWS Glue job. The job fails with an 'AccessDenied' error when trying to write to 's3://my-bucket/output/'. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The resource ARN for S3 should include the bucket itself.

The job fails with 'AccessDenied' when writing to S3. This is most likely because the IAM policy attached to the Glue role does not grant the s3:PutObject permission on the object ARN (e.g., 'arn:aws:s3:::my-bucket/output/*'). Option A points out that the resource ARN should include the bucket itself, which is a common error: if the policy uses the bucket ARN (without the /* suffix) for the PutObject action, it will not allow the write operation. Option C is incorrect because s3:ListBucket is not required for the PutObject action; it is needed for listing contents, not for writing. Option B is irrelevant to the S3 write failure. Option D (s3:GetObject) is for reading, not writing.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The resource ARN for S3 should include the bucket itself.
Why this is correct
This option indicates that the resource ARN for S3 should include the bucket itself. If the policy has s3:PutObject allowed on the bucket ARN (e.g., 'arn:aws:s3:::my-bucket') rather than on the object ARN (e.g., 'arn:aws:s3:::my-bucket/*'), the PutObject action will fail. Therefore, this is the most likely cause of the AccessDenied error.
✗
The glue:StartJobRun action is not allowed.
Why it's wrong here
glue:StartJobRun is an action for starting Glue jobs, not for S3 write operations. It would not cause an AccessDenied error when writing to S3.
✗
The policy does not grant s3:ListBucket permission.
Why it's wrong here
s3:ListBucket permission is not required for writing objects to S3. The PutObject action only requires permission on the object itself. ListBucket is needed for operations like listing contents or checking object existence, but it is not a prerequisite for a PutObject call.
✗
The s3:GetObject action is missing.
Why it's wrong here
s3:GetObject is used for reading objects from S3, not for writing. This action is not relevant to the write failure.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Ingestion and Transformation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question