A dental chain runs a patient-records database on SQL Server in its own data center. The data team wants a Glue crawler to read the schema of that database into the Data Catalog, so that Athena and Glue jobs can use it.
The crawler fails with connection timeouts. The network team has connected the data center to the AWS VPC with AWS Direct Connect, and the database user's password is stored in AWS Secrets Manager.
Which configuration allows the crawler to connect?
Choose one answer.
AA. Open the SQL Server port on the data center firewall to the entire internet, and point the crawler at the public address.
BB. Export the schema from SQL Server as a DDL script each night, and upload the script to S3 so that the crawler can read it as a file.
CC. Place the crawler in a public subnet with an internet gateway, and put the database password in the crawler's environment variables.
DD. Create a Glue connection with the password secret and a VPC subnet and security group that route to the data center.
Show the answer and explanation
Answer: D
A. Wrong: Opening a database to the internet exposes patient records to threats and breaks the network design. The option does not fit the data protection requirements for this data.
B. Wrong: A DDL export works for the schema, but it is a manual pipeline that the crawler is not needed for. The team asked for the crawler to read the database, so the option changes the design.
C. Wrong: A public subnet does not route to the data center, and environment variables are not how Glue passes credentials. The option stores the password in an unsafe place and still fails to route.
D. Right: Correct. A Glue connection holds the JDBC endpoint, credentials and the VPC subnet and security group the crawler uses. The subnet's route table sends traffic to the data center over Direct Connect, and the security group allows the database port. Learn more: Connecting to data (opens in a new tab)
Explanation
A Glue connection is the object that tells crawlers and jobs how to reach a database inside a VPC. It names the subnet and security group, so the crawler uses the Direct Connect route to the data center, and it refers to the password in Secrets Manager. Public exposure, schema exports and public subnets each break security or routing.
Want more on Glue Data Catalog and crawlers? The 5 full-length practice sets have 8 more Glue Data Catalog and crawlers questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →