Your company runs a critical data processing pipeline that ingests data from multiple sources into an Amazon S3 bucket. An AWS Glue ETL job processes this data and writes the output to an Amazon Redshift cluster. The pipeline is triggered by an S3 event notification that invokes an AWS Lambda function, which starts the Glue job. Recently, you have observed that the Glue job occasionally fails with an AccessDenied error when trying to access the S3 bucket. The IAM role used by the Glue job has the following policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::input-bucket", "arn:aws:s3:::input-bucket/*" ] }, { "Effect": "Allow", "Action": [ "redshift:CopyData" ], "Resource": "*" } ] }. The S3 bucket has a bucket policy that allows access only from a specific VPC. The Glue job runs in a VPC with the appropriate VPC endpoints configured. The error occurs intermittently and sometimes retries succeed. What is the most likely cause and correct course of action?

Question

Accepted Answer

Add a VPC endpoint for S3 and configure the bucket policy to allow access from the Glue job's VPC endpoint.. The Glue job intermittently fails with AccessDenied when accessing the S3 bucket because the bucket policy restricts access to requests originating from a specific VPC endpoint. Although the Glue job runs in a VPC, it does not automatically route S3 traffic through the VPC endpoint; it may use the internet or a different endpoint. The intermittent success occurs when requests happen to come from the allowed endpoint. To resolve this, ensure the Glue job's VPC configuration includes a VPC endpoint for S3, and update the bucket policy to allow access from that endpoint. Option B is incorrect because a NAT gateway would route traffic through the internet, which may be denied by the bucket policy. Option C is incorrect because the Lambda function's IAM role does not affect the Glue job's access. Option D is incorrect because the error is about reading from the input bucket, not writing to the output bucket, and the IAM role already has the necessary S3 permissions.

Answer

Ensure the Glue job's VPC configuration includes a NAT gateway to route traffic to S3.

Answer

Change the Lambda function to use a different IAM role with broader S3 permissions.

Answer

Modify the Glue job's IAM role to include s3:PutObject permission for the output bucket.

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

DEA-C01 Data Operations and Support Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question